Edit tour

Windows Analysis Report
Scancontract103.exe

Overview

General Information

Sample Name:	Scancontract103.exe
Analysis ID:	713039
MD5:	9d2a2b596cd979fc9674824d2aa731df
SHA1:	015e8ae0f838e0fba35643297530a5b9a66e4186
SHA256:	c4a2c953833c8d6b5d2ef71b997700559ecc9f23573d89072d205f963e46956c
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for domain / URL

Yara detected Nanocore RAT

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large strings

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Scancontract103.exe (PID: 3732 cmdline: "C:\Users\user\Desktop\Scancontract103.exe" MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 1760 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

schtasks.exe (PID: 2636 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2300 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Scancontract103.exe (PID: 6052 cmdline: C:\Users\user\Desktop\Scancontract103.exe 0 MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 3988 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 5588 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 5308 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 4632 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 2576 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 1012 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 2300 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 5420 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 408 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "c5cb65e3-79c3-43dc-bde0-43ed679c", "Group": "Default", "Domain1": "79.134.225.6", "Domain2": "", "Port": 60110, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xff8d:$a1: NanoCore.ClientPluginHost 0xff4d:$a2: NanoCore.ClientPlugin 0x11ea6:$b1: get_BuilderSettings 0xfda9:$b2: ClientLoaderForm.resources 0x115c6:$b3: PluginCommand 0xff7e:$b4: IClientAppHost 0x1a3fe:$b5: GetBlockHash 0x124fe:$b6: AddHostEntry 0x161f1:$b7: LogClientException 0x1246b:$b8: PipeExists 0xffb7:$b9: IClientLoggingHost
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4359d:$a: NanoCore 0x435f6:$a: NanoCore 0x43633:$a: NanoCore 0x436ac:$a: NanoCore 0x56d57:$a: NanoCore 0x56d6c:$a: NanoCore 0x56da1:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435ff:$b: ClientPlugin 0x4363c:$b: ClientPlugin 0x43f3a:$b: ClientPlugin 0x43f47:$b: ClientPlugin 0x56b13:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56b5e:$b: ClientPlugin 0x56d75:$b: ClientPlugin 0x56daa:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x43633:$a1: NanoCore.ClientPluginHost 0x56da1:$a1: NanoCore.ClientPluginHost 0x6fd75:$a1: NanoCore.ClientPluginHost 0x435f6:$a2: NanoCore.ClientPlugin 0x56d6c:$a2: NanoCore.ClientPlugin 0x6fd40:$a2: NanoCore.ClientPlugin 0x439ca:$b1: get_BuilderSettings 0x5bce7:$b1: get_BuilderSettings 0x74cbb:$b1: get_BuilderSettings 0x43681:$b4: IClientAppHost 0x43a3b:$b6: AddHostEntry 0x43aaa:$b7: LogClientException 0x5bc56:$b7: LogClientException 0x74c2a:$b7: LogClientException 0x43a1f:$b8: PipeExists 0x4366e:$b9: IClientLoggingHost 0x56dbb:$b9: IClientLoggingHost 0x6fd8f:$b9: IClientLoggingHost
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd06dd:$x1: NanoCore.ClientPluginHost 0xd071a:$x2: IClientNetworkHost 0xd424d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd0445:$a: NanoCore 0xd0455:$a: NanoCore 0xd0689:$a: NanoCore 0xd069d:$a: NanoCore 0xd06dd:$a: NanoCore 0xd04a4:$b: ClientPlugin 0xd06a6:$b: ClientPlugin 0xd06e6:$b: ClientPlugin 0xd05cb:$c: ProjectData 0xd0fd2:$d: DESCrypto 0xd899e:$e: KeepAlive 0xd698c:$g: LogClientMessage 0xd2b87:$i: get_Connected 0xd1308:$j: #=q 0xd1338:$j: #=q 0xd1354:$j: #=q 0xd1384:$j: #=q 0xd13a0:$j: #=q 0xd13bc:$j: #=q 0xd13ec:$j: #=q 0xd1408:$j: #=q
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd06dd:$a1: NanoCore.ClientPluginHost 0xd069d:$a2: NanoCore.ClientPlugin 0xd25f6:$b1: get_BuilderSettings 0xd04f9:$b2: ClientLoaderForm.resources 0xd1d16:$b3: PluginCommand 0xd06ce:$b4: IClientAppHost 0xdab4e:$b5: GetBlockHash 0xd2c4e:$b6: AddHostEntry 0xd6941:$b7: LogClientException 0xd2bbb:$b8: PipeExists 0xd0707:$b9: IClientLoggingHost
00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x2d0c9:$a1: NanoCore.ClientPluginHost 0x2d08c:$a2: NanoCore.ClientPlugin 0x2d460:$b1: get_BuilderSettings 0x2d117:$b4: IClientAppHost 0x2d4d1:$b6: AddHostEntry 0x2d540:$b7: LogClientException 0x2d4b5:$b8: PipeExists 0x2d104:$b9: IClientLoggingHost
00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69437:$a: NanoCore 0x69490:$a: NanoCore 0x694cd:$a: NanoCore 0x69546:$a: NanoCore 0x69499:$b: ClientPlugin 0x694d6:$b: ClientPlugin 0x69dd4:$b: ClientPlugin 0x69de1:$b: ClientPlugin 0x5f59f:$e: KeepAlive 0x69921:$g: LogClientMessage 0x698a1:$i: get_Connected 0x5986d:$j: #=q 0x5989d:$j: #=q 0x598d9:$j: #=q 0x59901:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599dd:$j: #=q 0x59a0d:$j: #=q
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x694cd:$a1: NanoCore.ClientPluginHost 0x69490:$a2: NanoCore.ClientPlugin 0x5ada7:$b1: get_BuilderSettings 0x69864:$b1: get_BuilderSettings 0x6951b:$b4: IClientAppHost 0x698d5:$b6: AddHostEntry 0x5ad16:$b7: LogClientException 0x69944:$b7: LogClientException 0x698b9:$b8: PipeExists 0x69508:$b9: IClientLoggingHost
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1a011d:$x1: NanoCore.ClientPluginHost 0x1a015a:$x2: IClientNetworkHost 0x1a3c8d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19fe85:$a: NanoCore 0x19fe95:$a: NanoCore 0x1a00c9:$a: NanoCore 0x1a00dd:$a: NanoCore 0x1a011d:$a: NanoCore 0x19fee4:$b: ClientPlugin 0x1a00e6:$b: ClientPlugin 0x1a0126:$b: ClientPlugin 0x1a000b:$c: ProjectData 0x289e10:$c: ProjectData 0x1a0a12:$d: DESCrypto 0x1a83de:$e: KeepAlive 0x1a63cc:$g: LogClientMessage 0x1a25c7:$i: get_Connected 0x1a0d48:$j: #=q 0x1a0d78:$j: #=q 0x1a0d94:$j: #=q 0x1a0dc4:$j: #=q 0x1a0de0:$j: #=q 0x1a0dfc:$j: #=q 0x1a0e2c:$j: #=q
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1a011d:$a1: NanoCore.ClientPluginHost 0x1a00dd:$a2: NanoCore.ClientPlugin 0x1a2036:$b1: get_BuilderSettings 0x19ff39:$b2: ClientLoaderForm.resources 0x1a1756:$b3: PluginCommand 0x1a010e:$b4: IClientAppHost 0x1aa58e:$b5: GetBlockHash 0x1a268e:$b6: AddHostEntry 0x1a6381:$b7: LogClientException 0x1a25fb:$b8: PipeExists 0x1a0147:$b9: IClientLoggingHost
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69383:$a: NanoCore 0x693dc:$a: NanoCore 0x69419:$a: NanoCore 0x69492:$a: NanoCore 0x693e5:$b: ClientPlugin 0x69422:$b: ClientPlugin 0x69d20:$b: ClientPlugin 0x69d2d:$b: ClientPlugin 0x5f4eb:$e: KeepAlive 0x6986d:$g: LogClientMessage 0x697ed:$i: get_Connected 0x597b9:$j: #=q 0x597e9:$j: #=q 0x59825:$j: #=q 0x5984d:$j: #=q 0x5987d:$j: #=q 0x598ad:$j: #=q 0x598dd:$j: #=q 0x5990d:$j: #=q 0x59929:$j: #=q 0x59959:$j: #=q
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x69419:$a1: NanoCore.ClientPluginHost 0x693dc:$a2: NanoCore.ClientPlugin 0x5acf3:$b1: get_BuilderSettings 0x697b0:$b1: get_BuilderSettings 0x69467:$b4: IClientAppHost 0x69821:$b6: AddHostEntry 0x5ac62:$b7: LogClientException 0x69890:$b7: LogClientException 0x69805:$b8: PipeExists 0x69454:$b9: IClientLoggingHost
Process Memory Space: Scancontract103.exe PID: 3732	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf3dc7:$x1: NanoCore.ClientPluginHost 0x15971a:$x1: NanoCore.ClientPluginHost 0xf3e04:$x2: IClientNetworkHost 0x159757:$x2: IClientNetworkHost 0xf78f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10297b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x15cebc:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x167e28:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Scancontract103.exe PID: 3732	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0xef1c1:$s5: AEAAAAMAAQqVT 0x4b1cf:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xcc3fb:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xef132:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: Scancontract103.exe PID: 3732	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Scancontract103.exe PID: 3732	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 3732	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf3a94:$a: NanoCore 0xf3aa4:$a: NanoCore 0xf3b63:$a: NanoCore 0xf3b72:$a: NanoCore 0xf3d73:$a: NanoCore 0xf3d87:$a: NanoCore 0xf3dc7:$a: NanoCore 0xfefe5:$a: NanoCore 0xfeff7:$a: NanoCore 0xff033:$a: NanoCore 0x159431:$a: NanoCore 0x159441:$a: NanoCore 0x1594b6:$a: NanoCore 0x1594c5:$a: NanoCore 0x1596c6:$a: NanoCore 0x1596da:$a: NanoCore 0x15971a:$a: NanoCore 0x164492:$a: NanoCore 0x1644a4:$a: NanoCore 0x1644e0:$a: NanoCore 0xf3af3:$b: ClientPlugin
Process Memory Space: Scancontract103.exe PID: 3732	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf3dc7:$a1: NanoCore.ClientPluginHost 0x15971a:$a1: NanoCore.ClientPluginHost 0xf3d87:$a2: NanoCore.ClientPlugin 0x1596da:$a2: NanoCore.ClientPlugin 0xf5c9e:$b1: get_BuilderSettings 0x15b26c:$b1: get_BuilderSettings 0xf3b48:$b2: ClientLoaderForm.resources 0x15949b:$b2: ClientLoaderForm.resources 0xf53be:$b3: PluginCommand 0x15a9a2:$b3: PluginCommand 0xf3db8:$b4: IClientAppHost 0x15970b:$b4: IClientAppHost 0xfe1f1:$b5: GetBlockHash 0x1637b8:$b5: GetBlockHash 0xf62f6:$b6: AddHostEntry 0x101415:$b6: AddHostEntry 0x15b8bd:$b6: AddHostEntry 0x1668c2:$b6: AddHostEntry 0xf9fe9:$b7: LogClientException 0x104f56:$b7: LogClientException 0x15f5b0:$b7: LogClientException
Process Memory Space: Scancontract103.exe PID: 1760	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x21dc1:$x1: NanoCore.ClientPluginHost 0x41b5d:$x1: NanoCore.ClientPluginHost 0x21dfe:$x2: IClientNetworkHost 0x41b77:$x2: IClientNetworkHost 0x258ef:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x30975:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Scancontract103.exe PID: 1760	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 1760	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xc1e8:$a: NanoCore 0x21a8e:$a: NanoCore 0x21a9e:$a: NanoCore 0x21b5d:$a: NanoCore 0x21b6c:$a: NanoCore 0x21d6d:$a: NanoCore 0x21d81:$a: NanoCore 0x21dc1:$a: NanoCore 0x2cfdf:$a: NanoCore 0x2cff1:$a: NanoCore 0x2d02d:$a: NanoCore 0x38066:$a: NanoCore 0x380c1:$a: NanoCore 0x38134:$a: NanoCore 0x41ac7:$a: NanoCore 0x41b20:$a: NanoCore 0x41b5d:$a: NanoCore 0x41bd6:$a: NanoCore 0x42480:$a: NanoCore 0x424d3:$a: NanoCore 0x4250c:$a: NanoCore
Process Memory Space: Scancontract103.exe PID: 1760	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x21dc1:$a1: NanoCore.ClientPluginHost 0x41b5d:$a1: NanoCore.ClientPluginHost 0x21d81:$a2: NanoCore.ClientPlugin 0x41b20:$a2: NanoCore.ClientPlugin 0x23c98:$b1: get_BuilderSettings 0x41ed7:$b1: get_BuilderSettings 0x21b42:$b2: ClientLoaderForm.resources 0x233b8:$b3: PluginCommand 0x21db2:$b4: IClientAppHost 0x41bab:$b4: IClientAppHost 0x2c1eb:$b5: GetBlockHash 0x242f0:$b6: AddHostEntry 0x2f40f:$b6: AddHostEntry 0x41f48:$b6: AddHostEntry 0x27fe3:$b7: LogClientException 0x32f50:$b7: LogClientException 0x41fb7:$b7: LogClientException 0x2425d:$b8: PipeExists 0x2f383:$b8: PipeExists 0x41f2c:$b8: PipeExists 0x21deb:$b9: IClientLoggingHost
Process Memory Space: Scancontract103.exe PID: 6052	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x14125:$s5: AEAAAAMAAQqVT 0x8217:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x14096:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: dhcpmon.exe PID: 5308	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x1e768:$s5: AEAAAAMAAQqVT 0x1e6d9:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x24032:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: dhcpmon.exe PID: 5308	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 1012	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x1359f:$s5: AEAAAAMAAQqVT 0x13510:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x16593:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: Scancontract103.exe PID: 5588	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 5588	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3296:$a: NanoCore 0x32ef:$a: NanoCore 0x332c:$a: NanoCore 0x33a5:$a: NanoCore 0x3c5e:$a: NanoCore 0x3cb1:$a: NanoCore 0x3cea:$a: NanoCore 0x3d5d:$a: NanoCore 0xb32f:$a: NanoCore 0xb342:$a: NanoCore 0xb374:$a: NanoCore 0x1104a:$a: NanoCore 0x1105d:$a: NanoCore 0x1108f:$a: NanoCore 0x17f59:$a: NanoCore 0x17fb4:$a: NanoCore 0x18028:$a: NanoCore 0x2d537:$a: NanoCore 0x2d590:$a: NanoCore 0x2d5cd:$a: NanoCore 0x2d646:$a: NanoCore
Process Memory Space: Scancontract103.exe PID: 5588	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x332c:$a1: NanoCore.ClientPluginHost 0x2d5cd:$a1: NanoCore.ClientPluginHost 0x32ef:$a2: NanoCore.ClientPlugin 0x2d590:$a2: NanoCore.ClientPlugin 0x36a6:$b1: get_BuilderSettings 0x26ce9:$b1: get_BuilderSettings 0x337a:$b4: IClientAppHost 0x2d61b:$b4: IClientAppHost 0x3717:$b6: AddHostEntry 0x2d92e:$b6: AddHostEntry 0x3786:$b7: LogClientException 0x26c58:$b7: LogClientException 0x36fb:$b8: PipeExists 0x2d912:$b8: PipeExists 0x3367:$b9: IClientLoggingHost 0x2d608:$b9: IClientLoggingHost
Process Memory Space: dhcpmon.exe PID: 2576	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 2576	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x36de:$a: NanoCore 0x5d51:$a: NanoCore 0x5dac:$a: NanoCore 0x5e20:$a: NanoCore 0x1b2bd:$a: NanoCore 0x1b316:$a: NanoCore 0x1b353:$a: NanoCore 0x1b3cc:$a: NanoCore 0x1bb5a:$a: NanoCore 0x1bbad:$a: NanoCore 0x1bbe6:$a: NanoCore 0x1bc59:$a: NanoCore 0x1c756:$a: NanoCore 0x165e8:$b: ClientPlugin 0x16629:$b: ClientPlugin 0x1b31f:$b: ClientPlugin 0x1b35c:$b: ClientPlugin 0x1bb0a:$b: ClientPlugin 0x1bb17:$b: ClientPlugin 0x1bbb6:$b: ClientPlugin 0x1bbef:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 2576	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1b353:$a1: NanoCore.ClientPluginHost 0x1b316:$a2: NanoCore.ClientPlugin 0x14a70:$b1: get_BuilderSettings 0x1b3a1:$b4: IClientAppHost 0x1b6b4:$b6: AddHostEntry 0x149df:$b7: LogClientException 0x1b698:$b8: PipeExists 0x1b38e:$b9: IClientLoggingHost
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
20.2.Scancontract103.exe.33695a4.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5b7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5e4:$x2: IClientNetworkHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5b7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e692:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5d1:$s5: IClientLoggingHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.434b7be.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d582:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d5b7:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d576:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d598:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d5a7:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d5d1:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d56d:$a: NanoCore 0x2d582:$a: NanoCore 0x2d5b7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d329:$b: ClientPlugin 0x2d344:$b: ClientPlugin
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0x145e3:$a1: NanoCore.ClientPluginHost 0x2d5b7:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x145ae:$a2: NanoCore.ClientPlugin 0x2d582:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0x19529:$b1: get_BuilderSettings 0x324fd:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x19498:$b7: LogClientException 0x3246c:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost 0x145fd:$b9: IClientLoggingHost 0x2d5d1:$b9: IClientLoggingHost
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
6.2.Scancontract103.exe.5900000.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5910000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5910000.4.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
6.2.Scancontract103.exe.5910000.4.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5910000.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
6.2.Scancontract103.exe.5910000.4.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
6.0.Scancontract103.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.Scancontract103.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.Scancontract103.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.Scancontract103.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.Scancontract103.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.0.Scancontract103.exe.400000.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5914629.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
6.2.Scancontract103.exe.5914629.5.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.3631550.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.3631550.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
0.2.Scancontract103.exe.3631550.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.Scancontract103.exe.3631550.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28781:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ae:$x2: IClientNetworkHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28781:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2985c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2879b:$s5: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.43505f4.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x2874c:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28781:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28740:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x28762:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28771:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x2879b:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x287ae:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x287c1:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x287cf:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x287eb:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0x28781:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x2874c:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x2d6c7:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0x2d636:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost 0x2879b:$b9: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.3631550.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.3631550.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.Scancontract103.exe.3631550.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.Scancontract103.exe.3631550.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe38d:$a1: NanoCore.ClientPluginHost 0xe34d:$a2: NanoCore.ClientPlugin 0x102a6:$b1: get_BuilderSettings 0xe1a9:$b2: ClientLoaderForm.resources 0xf9c6:$b3: PluginCommand 0xe37e:$b4: IClientAppHost 0x187fe:$b5: GetBlockHash 0x108fe:$b6: AddHostEntry 0x145f1:$b7: LogClientException 0x1086b:$b8: PipeExists 0xe3b7:$b9: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
20.2.Scancontract103.exe.43505f4.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.43505f4.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
20.2.Scancontract103.exe.43505f4.3.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xbd71d:$x1: NanoCore.ClientPluginHost 0xbd75a:$x2: IClientNetworkHost 0xc128d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xbd485:$x1: NanoCore Client 0xbd495:$x1: NanoCore Client 0xbd6dd:$x2: NanoCore.ClientPlugin 0xbd71d:$x3: NanoCore.ClientPluginHost 0xbd6d2:$i1: IClientApp 0xbd6f3:$i2: IClientData 0xbd6ff:$i3: IClientNetwork 0xbd70e:$i4: IClientAppHost 0xbd737:$i5: IClientDataHost 0xbd747:$i6: IClientLoggingHost 0xbd75a:$i7: IClientNetworkHost 0xbd76d:$i8: IClientUIHost 0xbd77b:$i9: IClientNameObjectCollection 0xbd797:$i10: IClientReadOnlyNameObjectCollection 0xbd4e4:$s1: ClientPlugin 0xbd6e6:$s1: ClientPlugin 0xbdbda:$s2: EndPoint 0xbdbe3:$s3: IPAddress 0xbdbed:$s4: IPEndPoint 0xbf623:$s6: get_ClientSettings 0xbfbc7:$s7: get_Connected
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xbd485:$a: NanoCore 0xbd495:$a: NanoCore 0xbd6c9:$a: NanoCore 0xbd6dd:$a: NanoCore 0xbd71d:$a: NanoCore 0xbd4e4:$b: ClientPlugin 0xbd6e6:$b: ClientPlugin 0xbd726:$b: ClientPlugin 0xbd60b:$c: ProjectData 0x1a7410:$c: ProjectData 0xbe012:$d: DESCrypto 0xc59de:$e: KeepAlive 0xc39cc:$g: LogClientMessage 0xbfbc7:$i: get_Connected 0xbe348:$j: #=q 0xbe378:$j: #=q 0xbe394:$j: #=q 0xbe3c4:$j: #=q 0xbe3e0:$j: #=q 0xbe3fc:$j: #=q 0xbe42c:$j: #=q
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xbd71d:$a1: NanoCore.ClientPluginHost 0xbd6dd:$a2: NanoCore.ClientPlugin 0xbf636:$b1: get_BuilderSettings 0xbd539:$b2: ClientLoaderForm.resources 0xbed56:$b3: PluginCommand 0xbd70e:$b4: IClientAppHost 0xc7b8e:$b5: GetBlockHash 0xbfc8e:$b6: AddHostEntry 0xc3981:$b7: LogClientException 0xbfbfb:$b8: PipeExists 0xbd747:$b9: IClientLoggingHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24158:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x24185:$x2: IClientNetworkHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24158:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25233:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24172:$s5: IClientLoggingHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x24123:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x24158:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x24117:$i2: IClientData 0xb165:$i3: IClientNetwork 0x24139:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x24148:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x24172:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x24185:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x24198:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x241a6:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x241c2:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0x24158:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x24123:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x2909e:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0x2900d:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost 0x24172:$b9: IClientLoggingHost
Click to see the 69 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\Scancontract103.exe, ParentProcessId: 1760, ParentProcessName: Scancontract103.exe, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, ProcessId: 2636, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Scancontract103.exe

Virustotal: Detection: 40%

Perma Link

Multi AV Scanner detection for domain / URL

Source: 79.134.225.6

Virustotal: Detection: 6%

Perma Link

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Machine Learning detection for sample

Source: Scancontract103.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Source: 6.0.Scancontract103.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.Scancontract103.exe.5910000.4.unpack	Avira: Label: TR/NanoCore.fadte

Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "c5cb65e3-79c3-43dc-bde0-43ed679c", "Group": "Default", "Domain1": "79.134.225.6", "Domain2": "", "Port": 60110, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Source: Scancontract103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Scancontract103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: 79.134.225.6

Source: Joe Sandbox View

ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH

Source: Joe Sandbox View

IP Address: 79.134.225.6 79.134.225.6

Source: global traffic

TCP traffic: 192.168.2.3:49707 -> 79.134.225.6:60110

Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6

Source: Scancontract103.exe, 00000000.00000003.265302103.000000000598D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.wikip
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Scancontract103.exe, 00000000.00000003.266935495.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Scancontract103.exe, 00000000.00000003.269009492.00000000059C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commv
Source: Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Scancontract103.exe, 00000000.00000003.260309270.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comc
Source: Scancontract103.exe, 00000000.00000003.263528849.0000000005986000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263806579.000000000598E000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cna-d
Source: Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cntyp9
Source: Scancontract103.exe, 00000000.00000003.272557005.00000000059C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Scancontract103.exe, 00000000.00000003.266747836.00000000059C6000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: dhcpmon.exe, 00000010.00000002.390909200.00000000016B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\Scancontract103.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown

.NET source code contains very large strings

Source: Scancontract103.exe, FrmMain.cs	Long String: Length: 129663
Source: 0.0.Scancontract103.exe.170000.0.unpack, FrmMain.cs	Long String: Length: 129663
Source: dhcpmon.exe.6.dr, FrmMain.cs	Long String: Length: 129663

Source: Scancontract103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 6052, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: dhcpmon.exe PID: 5308, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: dhcpmon.exe PID: 1012, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 0_2_049FD4B4	0_2_049FD4B4
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145E471	6_2_0145E471
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145E480	6_2_0145E480
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145BBD4	6_2_0145BBD4
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D6550	6_2_053D6550
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DD4E8	6_2_053DD4E8
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D3E30	6_2_053D3E30
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DC8D0	6_2_053DC8D0
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D4A50	6_2_053D4A50
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DD5A6	6_2_053DD5A6
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D4B08	6_2_053D4B08

Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D8ED0 NtSetInformationProcess,		6_2_053D8ED0
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D8EC9 NtSetInformationProcess,		6_2_053D8EC9

Source: Scancontract103.exe, 00000000.00000000.254620443.0000000000172000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename8voN7Es.exe: vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.326192763.00000000075A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.325921725.00000000073F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.546358238.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.548456934.0000000006360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 0000000F.00000002.398015480.000000000438A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 0000000F.00000002.398402298.0000000004519000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe	Binary or memory string: OriginalFilename8voN7Es.exe: vs Scancontract103.exe

Source: Scancontract103.exe

Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\Scancontract103.exe

File read: C:\Users\user\Desktop\Scancontract103.exe

Jump to behavior

Source: Scancontract103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Scancontract103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@26/8@0/1

Source: Scancontract103.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5056:120:WilError_01
Source: C:\Users\user\Desktop\Scancontract103.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c5cb65e3-79c3-43dc-bde0-43ed679c8c9b}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4744:120:WilError_01

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: Scancontract103.exe, 00000000.00000003.275810844.000000000598C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: DITC Blackadder is a Trademark of International Typeface Corporation.slnt

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Scancontract103.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Scancontract103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Scancontract103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: Scancontract103.exe, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)
Source: 0.0.Scancontract103.exe.170000.0.unpack, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)
Source: dhcpmon.exe.6.dr, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)

Source: C:\Users\user\Desktop\Scancontract103.exe

Code function: 6_2_053DFC4A push FFFFFFE0h; ret

6_2_053DFC4C

Source: initial sample	Static PE information: section name: .text entropy: 7.0886542606348
Source: initial sample	Static PE information: section name: .text entropy: 7.0886542606348

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Scancontract103.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Scancontract103.exe

File opened: C:\Users\user\Desktop\Scancontract103.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5308, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 0000000F.00000002.395467089.000000000318B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 0000000F.00000002.395467089.000000000318B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238998s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238273s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238138s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237736s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237475s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237232s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237091s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236976s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236621s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236130s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234433s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5352	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 2384	Thread sleep count: 9421 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235681s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235364s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234995s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234820s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234697s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234588s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233068s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232341s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231386s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231154s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230229s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229943s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228685s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227887s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227047s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239703s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239250s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238844s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238686s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238546s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238344s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238034s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237891s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237750s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237619s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237483s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237349s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236881s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236750s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236593s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236466s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236250s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235891s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235717s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235531s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235384s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235265s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235141s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234841s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234715s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234593s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234426s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234296s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234170s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234042s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233856s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233746s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233605s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233302s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233141s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232995s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232844s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232733s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232594s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232327s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232141s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231989s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231844s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231703s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231573s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231467s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231354s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231244s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230994s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230859s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230732s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230587s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230324s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230200s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230060s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229920s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229794s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229641s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239703s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239202s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239088s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238889s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238656s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238356s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238250s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238140s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237844s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237687s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237547s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237385s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237250s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237062s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236906s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236750s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236547s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236406s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236062s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235887s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235748s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235517s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235297s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235186s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235059s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234936s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234652s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234368s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234230s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234086s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233953s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233780s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233640s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233511s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233341s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233115s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232953s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232794s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232656s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232484s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232331s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232213s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232092s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231953s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231826s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231656s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231484s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231344s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231073s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230844s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230656s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230406s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230203s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229594s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229406s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229244s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229053s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -228047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1096	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239468	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239359	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239234	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239109	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238998	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238874	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238717	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238273	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238138	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237999	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237856	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237736	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237475	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237359	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237232	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237091	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236976	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236621	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236374	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236265	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236130	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235983	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235749	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235625	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235484	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235202	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235093	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234983	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234562	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234433	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234311	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234202	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234076	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233670	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233545	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233422	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233296	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233156	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236344	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236218	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236094	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235968	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235840	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235681	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235364	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235203	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234995	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234820	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234697	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234588	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234453	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234156	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234046	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233406	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233203	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233068	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232939	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232341	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232186	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231844	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231546	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231386	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231264	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231154	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231039	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230906	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230776	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230639	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230531	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230373	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230229	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230094	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229943	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229656	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229515	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229376	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229125	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228999	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228685	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228546	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228435	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228297	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228170	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228042	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227887	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227453	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227201	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227047	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238686	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238546	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238344	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238034	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237891	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237619	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237483	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237349	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236881	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236593	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236466	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235891	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235717	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235531	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235384	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235265	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234841	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234715	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234593	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234426	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234296	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234170	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234042	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233856	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233746	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233605	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233302	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232995	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232733	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232594	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232327	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231989	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231573	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231467	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231354	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231244	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231109	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230994	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230859	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230732	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230587	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230324	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230200	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230060	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229920	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229794	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229641	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239202	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239088	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238889	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238356	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238140	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237687	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237547	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237385	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237062	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236906	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236062	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235887	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235748	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235517	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235297	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235186	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235059	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234936	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234797	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234652	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234368	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234230	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234086	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233780	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233640	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233511	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233341	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233115	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232794	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232484	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232331	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232213	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232092	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231826	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231484	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231344	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231073	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229594	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229244	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229053	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 228047	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 8928	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 9578	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: foregroundWindowGot 675	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 9421	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Window / User API: threadDelayed 9541	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Window / User API: threadDelayed 9561	Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239468	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239359	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239234	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239109	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238998	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238874	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238717	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238273	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238138	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237999	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237856	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237736	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237475	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237359	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237232	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237091	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236976	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236621	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236374	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236265	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236130	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235983	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235749	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235625	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235484	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235202	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235093	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234983	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234859	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234562	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234433	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234311	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234202	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234076	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233670	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233545	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233422	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233296	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233156	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236344	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236218	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236094	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235968	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235840	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235681	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235364	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235203	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234995	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234820	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234697	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234588	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234453	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234156	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234046	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233406	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233203	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233068	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232939	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232500	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232341	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232186	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232000	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231844	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231703	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231546	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231386	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231264	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231154	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231039	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230906	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230776	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230639	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230531	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230373	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230229	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230094	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229943	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229656	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229515	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229376	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229125	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228999	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228797	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228685	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228546	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228435	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228297	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228170	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228042	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227887	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227750	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227594	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227453	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227328	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227201	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227047	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238686	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238546	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238344	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238034	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237891	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237619	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237483	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237349	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236881	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236593	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236466	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235891	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235717	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235531	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235384	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235265	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234841	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234715	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234593	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234426	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234296	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234170	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234042	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233856	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233746	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233605	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233302	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232995	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232733	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232594	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232327	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232141	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231989	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231573	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231467	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231354	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231244	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231109	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230994	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230859	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230732	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230587	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230324	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230200	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230060	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229920	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229794	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229641	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239453	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239202	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239088	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238889	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238356	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238140	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238000	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237687	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237547	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237385	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237250	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237062	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236906	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236547	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236062	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235887	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235748	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235517	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235297	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235186	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235059	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234936	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234797	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234652	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234500	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234368	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234230	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234086	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233780	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233640	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233511	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233341	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233115	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232794	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232484	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232331	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232213	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232092	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231953	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231826	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231484	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231344	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231073	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230844	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230656	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230203	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229594	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229406	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229244	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229053	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 228047	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Scancontract103.exe	Memory written: C:\Users\user\Desktop\Scancontract103.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Memory written: C:\Users\user\Desktop\Scancontract103.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}	Jump to behavior

Source: Scancontract103.exe, 00000006.00000002.548631838.00000000064DD000.00000004.00000010.00020000.00000000.sdmp, Scancontract103.exe, 00000006.00000002.545166472.00000000032B7000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000006.00000002.533870000.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Scancontract103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: Scancontract103.exe, 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	2 Masquerading	21 Input Capture	11 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scancontract103.exe	40%	Virustotal		Browse
Scancontract103.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.0.Scancontract103.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File
6.2.Scancontract103.exe.5910000.4.unpack	100%	Avira	TR/NanoCore.fadte		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cna-d	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://en.wikip	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
79.134.225.6	7%	Virustotal		Browse
http://www.sakkal.com	0%	URL Reputation	safe
79.134.225.6	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cntyp9	0%	Avira URL Cloud	safe
http://www.fontbureau.commv	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
79.134.225.6	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	Scancontract103.exe, 00000000.00000003.272557005.00000000059C6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.comc	Scancontract103.exe, 00000000.00000003.260309270.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cntyp9	Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cna-d	Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://en.wikip	Scancontract103.exe, 00000000.00000003.265302103.000000000598D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Scancontract103.exe, 00000000.00000003.263528849.0000000005986000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263806579.000000000598E000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comoitu	Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	Scancontract103.exe, 00000000.00000003.266935495.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commv	Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Scancontract103.exe, 00000000.00000003.266747836.00000000059C6000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	Scancontract103.exe, 00000000.00000003.269009492.00000000059C5000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.134.225.6	unknown	Switzerland		6775	FINK-TELECOM-SERVICESCH	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	713039
Start date and time:	2022-09-29 22:57:49 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Scancontract103.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@26/8@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 43 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:58:48	API Interceptor	969x Sleep call for process: Scancontract103.exe modified
22:59:13	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
22:59:16	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\Scancontract103.exe" s>$(Arg0)
22:59:16	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
22:59:26	API Interceptor	255x Sleep call for process: dhcpmon.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
79.134.225.6	55DHL RECEIPT DOCUMENT.js	Get hash	malicious	Browse	ablegod.hopto.org:6439/is-ready

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FINK-TELECOM-SERVICESCH	Order#00573444985776877________________.exe	Get hash	malicious	Browse	79.134.225.7
	INQ - O26.jar	Get hash	malicious	Browse	79.134.225.85
	INQ - O26.jar	Get hash	malicious	Browse	79.134.225.85
	Order_RI678922.20220926.js	Get hash	malicious	Browse	79.134.225.83
	IMG2022926.js	Get hash	malicious	Browse	79.134.225.77
	DHL_Shipment-Notification_5596073630-QURY-93838392-27273827273-courier.exe	Get hash	malicious	Browse	79.134.225.92
	INQ-022UCI.jar	Get hash	malicious	Browse	79.134.225.85
	INQ-022UCI.jar	Get hash	malicious	Browse	79.134.225.85
	IMG-SCAN210922.exe	Get hash	malicious	Browse	79.134.225.75
	Shiping Details PL BL Draft IVN-FDX54635537355.exe	Get hash	malicious	Browse	79.134.225.36
	image2021042GFREDS12322ERDQ1DOC03027382DOC202.exe	Get hash	malicious	Browse	79.134.225.116
	DWG spare parts 455RTMGF Model.exe	Get hash	malicious	Browse	79.134.225.115
	Factura.exe	Get hash	malicious	Browse	79.134.225.11
	SecuriteInfo.com.Variant.Lazy.243659.18139.7481.exe	Get hash	malicious	Browse	79.134.225.36
	SecuriteInfo.com.Variant.Jaik.95298.16760.17387.exe	Get hash	malicious	Browse	79.134.225.115
	mlipidpmoe.exe	Get hash	malicious	Browse	79.134.225.22
	Payment EFT.xls	Get hash	malicious	Browse	79.134.225.8
	COADO 0000236 DTD.exe	Get hash	malicious	Browse	79.134.225.6
	D2 DMF OPEN PARTUPS.exe	Get hash	malicious	Browse	79.134.225.6
	D2 DMF OPEN PARTUPS (2).exe	Get hash	malicious	Browse	79.134.225.27

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	854528
Entropy (8bit):	7.084655686253337
Encrypted:	false
SSDEEP:	12288:sx9I2iNl/joW7EsJ2uM1DgC9tqGdpb5QyXYzvtMdADqjJ5ns:N1fEW7T4RDgvGdpHYzQjrs
MD5:	9D2A2B596CD979FC9674824D2AA731DF
SHA1:	015E8AE0F838E0FBA35643297530A5B9A66E4186
SHA-256:	C4A2C953833C8D6B5D2EF71B997700559ECC9F23573D89072D205F963E46956C
SHA-512:	768843F52697AC5A8E8FF71FF5A66BCA977CC6FAD9DA349CE77EEE431AA5252EC07187D52BCE92BD50BBCEC1A10B6CE1A9123DBAFA1E34D7A36AC2A9E511CEF3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5c..............P.................. ... ....@.. .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........Z...W......;...\|....a............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r/..p~....o-...(......t$....+..*...0..&........(....rA..p~....o-...(......

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84bE4KnKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxvbHKnYHKhQnoPtHoxH5
MD5:	A7D610296B11732FD61A88BC218783AC
SHA1:	EE89E72AF3A15DAB847055A9F9F88FD934113857
SHA-256:	7F3A7CE69B42D8C832F0FBB57C0523D6F098DC090D39616C05277F8DB9F4F9E9
SHA-512:	8C0AC1893FF0A7FE287D4FC650943D33D1546200A89C2A502FE9BCB11DA6227533FD8F966EE8651B7E7BD8B5EA11403AD930D022D1D75B3EAA6D24D625F779DF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

Download File

Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84bE4KnKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxvbHKnYHKhQnoPtHoxH5
MD5:	A7D610296B11732FD61A88BC218783AC
SHA1:	EE89E72AF3A15DAB847055A9F9F88FD934113857
SHA-256:	7F3A7CE69B42D8C832F0FBB57C0523D6F098DC090D39616C05277F8DB9F4F9E9
SHA-512:	8C0AC1893FF0A7FE287D4FC650943D33D1546200A89C2A502FE9BCB11DA6227533FD8F966EE8651B7E7BD8B5EA11403AD930D022D1D75B3EAA6D24D625F779DF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configu

C:\Users\user\AppData\Local\Temp\tmp1090.tmp

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	5.103232147891814
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0hxtn:cbk4oL600QydbQxIYODOLedq3Ij
MD5:	965D081052473031B1DA64E2A9CA6356
SHA1:	2CE6D29C2C4C5E0AAF98B74E3661A7C8A214B554
SHA-256:	81A542AC638DC1591CE04076330AAC190AA871FCD83AD2F3AB3C758BF6BB7713
SHA-512:	27338E725AB8992E95A77425347AED5878829AAEBBBFF14348E610DB2F8255F812CDAA636E11B1128C1637C982C4B8E58E670FD8D4F97E6694C8A4EDE849A8B4
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:YRH/t:Yhl
MD5:	3D6AAF34F494EBB7AEE72D9F1E409974
SHA1:	AB6D9E593DF00E22315A1ED553CAFA40EFEE1FBA
SHA-256:	D1B3C5C1EB2839519CA0B0E4E5DCF6120D0A14E2D81056AC11F2057443740705
SHA-512:	14B3475E8E166D8351CC349F62EF6B1572793E07A6ADA611C2B4412A17951D4A3D08BC757F4D8542AB98E6A9024F4873F7417B7996B6B710BA2A8A54BF6087B5
Malicious:	true
Preview:	.l...H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.350068910616443
Encrypted:	false
SSDEEP:	3:oNWXp5v2GOUDu:oNWXpF2/
MD5:	AA619EA44F715A3F4CF627DD80CFED11
SHA1:	5BFC5B8E726014C10FD0226AFAE783DEC203CB6B
SHA-256:	25186E981F6DA5CA846C5BC3A97592D4D39BA2F43AB7AA2A0B4088C5FA54AAB4
SHA-512:	2255746B212D29944BDA7AFD8294D5A3E073908670BFDA9038FB68C056302F4F01B757AC22F95A72076443690B6228B73A9A94CB5383E2CE510ED98910B43DA3
Malicious:	false
Preview:	C:\Users\user\Desktop\Scancontract103.exe

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.084655686253337
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Scancontract103.exe
File size:	854528
MD5:	9d2a2b596cd979fc9674824d2aa731df
SHA1:	015e8ae0f838e0fba35643297530a5b9a66e4186
SHA256:	c4a2c953833c8d6b5d2ef71b997700559ecc9f23573d89072d205f963e46956c
SHA512:	768843f52697ac5a8e8ff71ff5a66bca977cc6fad9da349ce77eee431aa5252ec07187d52bce92bd50bbcec1a10b6ce1a9123dbafa1e34d7a36ac2a9e511cef3
SSDEEP:	12288:sx9I2iNl/joW7EsJ2uM1DgC9tqGdpb5QyXYzvtMdADqjJ5ns:N1fEW7T4RDgvGdpHYzQjrs
TLSH:	11054A2429EB922CF4B69BF95FC8F8FB4C5BFA61252960F624A153468B33E05CCD1435
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5c..............P.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d13d6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63358100 [Thu Sep 29 11:26:56 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd1384	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x11ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcf3dc	0xcf400	False	0.697853447300965	COM executable for DOS	7.0886542606348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd2000	0x11ec	0x1200	False	0.3947482638888889	data	5.057459517659846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd2090	0x330	data
RT_MANIFEST	0xd23d0	0xe15	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2022 22:59:20.027470112 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:20.040286064 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:20.590548992 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:20.603280067 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:21.293834925 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:21.306813955 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:26.231312990 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:26.244163036 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:26.762944937 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:26.775790930 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:27.372375965 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:27.385637999 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:31.717842102 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:31.732376099 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:32.294923067 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:32.307845116 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:32.888734102 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:32.901580095 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:37.211786985 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:37.224678040 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:37.763921022 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:37.776861906 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:38.373284101 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:38.386439085 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:43.012607098 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:43.025531054 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:43.592551947 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:43.605590105 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:44.295752048 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:44.308585882 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:48.728755951 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:48.741656065 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:49.296158075 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:49.309087992 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:49.983714104 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:49.996527910 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:54.070527077 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:54.083321095 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:54.765382051 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:54.778515100 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:55.374838114 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:55.387594938 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:59.943087101 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:59.956547022 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:00.484608889 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:00.499109030 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:01.094042063 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:01.107193947 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:05.524106979 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:05.537091970 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:06.082381010 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:06.095248938 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:06.766412020 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:06.779191971 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:10.834242105 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:10.847059965 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:11.464692116 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:11.477426052 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:11.985686064 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:11.998442888 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:16.608930111 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:16.621793032 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:17.267476082 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:17.280277967 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:17.876717091 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:17.890031099 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:21.904520988 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:21.918123960 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:22.486566067 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:22.499701023 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:23.174092054 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:23.187195063 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:27.675836086 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:27.688648939 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:28.205789089 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:28.218532085 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:28.721540928 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:28.734438896 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:32.754986048 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:32.768208027 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:33.268742085 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:33.281815052 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:33.784370899 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:33.797348976 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:37.803364038 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:37.816562891 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:38.316065073 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:38.329046965 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:38.831706047 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:38.844505072 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:42.998397112 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:43.011187077 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:43.597734928 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:43.610474110 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:44.207194090 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:44.220000029 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:48.225795031 CEST	49723	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:48.238611937 CEST	60110	49723	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:48.754570961 CEST	49723	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:48.767365932 CEST	60110	49723	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:49.270056963 CEST	49723	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:49.282869101 CEST	60110	49723	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:53.286959887 CEST	49724	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:53.299632072 CEST	60110	49724	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:53.801707029 CEST	49724	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:53.814462900 CEST	60110	49724	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:54.317380905 CEST	49724	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:54.330388069 CEST	60110	49724	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:58.335747957 CEST	49725	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:58.348624945 CEST	60110	49725	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:58.849018097 CEST	49725	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:58.862549067 CEST	60110	49725	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:59.364701033 CEST	49725	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:59.377584934 CEST	60110	49725	79.134.225.6	192.168.2.3
Sep 29, 2022 23:01:03.396958113 CEST	49726	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:01:03.409895897 CEST	60110	49726	79.134.225.6	192.168.2.3
Sep 29, 2022 23:01:04.005707026 CEST	49726	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:01:04.018582106 CEST	60110	49726	79.134.225.6	192.168.2.3
Sep 29, 2022 23:01:04.599524021 CEST	49726	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:01:04.612333059 CEST	60110	49726	79.134.225.6	192.168.2.3

Target ID:	0
Start time:	22:58:46
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scancontract103.exe"
Imagebase:	0x170000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	22:59:07
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x970000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	22:59:14
Start date:	29/09/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp
Imagebase:	0x7ff745070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	22:59:14
Start date:	29/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	22:59:15
Start date:	29/09/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp
Imagebase:	0x1160000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	22:59:15
Start date:	29/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	22:59:16
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Scancontract103.exe 0
Imagebase:	0xd50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	22:59:16
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Imagebase:	0xe90000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	17
Start time:	22:59:22
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Imagebase:	0xa70000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	22:59:45
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x2a0000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	19
Start time:	22:59:45
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x390000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	20
Start time:	22:59:46
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xd50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	21
Start time:	22:59:46
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x990000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	22
Start time:	22:59:53
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x180000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	23
Start time:	22:59:55
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	24
Start time:	22:59:55
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x870000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	146
Total number of Limit Nodes:	7

Executed Functions

Function 049FAC88 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 049FAECE

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4df7e2de4f5d3ee23983af6946175603d8449204b64a49cb125b5da8095aa0e3
Instruction ID: 14e10d38657627c7dc0ed74df3853c1cd539745b46abcf8ead15a517389dcac3
Opcode Fuzzy Hash: 4df7e2de4f5d3ee23983af6946175603d8449204b64a49cb125b5da8095aa0e3
Instruction Fuzzy Hash: C67123B0A00B058FDB24DF69D84475ABBF5FF88304F008929D68ADBA50DB75F8458B91

Uniqueness

Uniqueness Score: -1.00%

Function 049FB9F4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,049FD15E,?,?,?,?,?), ref: 049FD627

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6f356554d4af547d9f7bf920f72faa2c204d2b31e6f07cb9eafb63040f71f9c1
Instruction ID: 9630b70a747acb16d27aa025f1a9206e54f08ebddfda0737f095e34877b2604d
Opcode Fuzzy Hash: 6f356554d4af547d9f7bf920f72faa2c204d2b31e6f07cb9eafb63040f71f9c1
Instruction Fuzzy Hash: 3521E7B59002099FDB10CF99D884BDEBBF8EB48324F14846AE915A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 049FD598 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,049FD15E,?,?,?,?,?), ref: 049FD627

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2733c0dd6d38b98986d681b63f355cfb45f498db8f9509f5f426d19af748ace3
Instruction ID: dc042f7484e89f822b54c20cef3e2fbd37af19abf008cb3ed326b282a5833bcd
Opcode Fuzzy Hash: 2733c0dd6d38b98986d681b63f355cfb45f498db8f9509f5f426d19af748ace3
Instruction Fuzzy Hash: 4A21E5B59012099FDB10CF9AD984ADEFBF8FB48324F14846AE919A7310D378A945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 049F7447 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 049F74D2

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 42fddfcbc34dfd8ff8f96ad923899bdea94090d38dae28b8cd8eb2eedb14af80
Instruction ID: aa26e172f0dfe9ba20f0d50ae2579ef8ddfe42ea529e138d73f21de4f8d5f671
Opcode Fuzzy Hash: 42fddfcbc34dfd8ff8f96ad923899bdea94090d38dae28b8cd8eb2eedb14af80
Instruction Fuzzy Hash: FB219DB29003458FEF50CFA5D9487DABFF8FB99364F108469C805A3241E779A506CF62

Uniqueness

Uniqueness Score: -1.00%

Function 049F76F8 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 049F777D

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2ba9baddbed2e2917be1d40501de5edfb5759e6d5698dfd399e110ab3b886168
Instruction ID: c3a459bb75dca3d232afbd21bc1fc2d302f43ff56b8ae293b66da6e5b7f8fa84
Opcode Fuzzy Hash: 2ba9baddbed2e2917be1d40501de5edfb5759e6d5698dfd399e110ab3b886168
Instruction Fuzzy Hash: 6621AEB18107459FEB20DFE8DA443DABFF8FB58318F1044AAC404A7641D3386506CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 049F9FE8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,049FAF49,00000800,00000000,00000000), ref: 049FB15A

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f776177b73a57976a4f427dd5adf7e4ebe4ba576a440850a26f8f29ad6430568
Instruction ID: bd08689a7267266700ce872531f7ceb564c2bb765c83207f9d3ae57af08982e1
Opcode Fuzzy Hash: f776177b73a57976a4f427dd5adf7e4ebe4ba576a440850a26f8f29ad6430568
Instruction Fuzzy Hash: 6A1114B29003099FDB10CF9AD844BDEFBF8EB88324F14842AE519A7200D779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 049F7458 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 049F74D2

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 91e63e4e1a5f0448a3e170c9c733a5d359c867174b31d9f40bd5fe2bb88b2a78
Instruction ID: 6893f74488a2428a16e23e86f00c21142ce6d28a20f745fc40fe2e875befaaca
Opcode Fuzzy Hash: 91e63e4e1a5f0448a3e170c9c733a5d359c867174b31d9f40bd5fe2bb88b2a78
Instruction Fuzzy Hash: 8A116AB0A003098FDF10CFA5DA4879ABFF8FB89364F108469D805A3240D779A5458FA5

Uniqueness

Uniqueness Score: -1.00%

Function 049F7708 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 049F777D

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 76e6b4ca8c310cc0c791cd0fb589dbb43cfa9b02551a5035c7f6e5145a66979b
Instruction ID: 04ecd4cadf05c153558bd217bc9f1b9dad6ad655ad104d9d269c3d334a238687
Opcode Fuzzy Hash: 76e6b4ca8c310cc0c791cd0fb589dbb43cfa9b02551a5035c7f6e5145a66979b
Instruction Fuzzy Hash: A5118BB19107498FDB20DFE9DA4479EBBF8EB98318F2044ADC509A7340D779A905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 049FB0E9 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,049FAF49,00000800,00000000,00000000), ref: 049FB15A

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ff2e8509d24811f5ff07b0813ea210e4ca7e3c803a679076fa6897a80b1e2d4e
Instruction ID: 54813a3e0735044750c9d9d25401bc318556871551dc2f7f83b3d64dfbd61573
Opcode Fuzzy Hash: ff2e8509d24811f5ff07b0813ea210e4ca7e3c803a679076fa6897a80b1e2d4e
Instruction Fuzzy Hash: DA11F6B6D00209CFDB10CFAAD944BDEFBF8AB88324F14842AD529B7640C775A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 049FAE61 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 049FAECE

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 49b6cd64a08fd3fd0a8c3507d00868501fd555be8aa7ee3b931cee6638cf4240
Instruction ID: 195785aa9e52f4803a941d25f40857ad0ddea2c6c3f5e2827cf400b9125aaf31
Opcode Fuzzy Hash: 49b6cd64a08fd3fd0a8c3507d00868501fd555be8aa7ee3b931cee6638cf4240
Instruction Fuzzy Hash: BC1119B5C016098FDB10CF9AD844BDFFBF9EB48314F14842AD519A7600C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 049FAE68 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 049FAECE

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a47712f444420cc86550d251d0cb82eda726867c3c2bcee8197ed549f9029d8d
Instruction ID: cc08582033eb53393d1c3bd8f8ea3eaf8afab06a64c6fa09e2a6db8ffb65f90f
Opcode Fuzzy Hash: a47712f444420cc86550d251d0cb82eda726867c3c2bcee8197ed549f9029d8d
Instruction Fuzzy Hash: EB11E0B6C006498FDB10CF9AD848BDFFBF8AB88324F14846AD519A7600D779A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 049FD4B4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.315523585.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49f0000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a5efca7de5bf216844db657cc8acce112204b5f805bd6620d867b8c13821a5
Instruction ID: 5343b6a384381218faf0d892b3509cb648ef200d0f8f4577b9a67ee5dc58a768
Opcode Fuzzy Hash: e6a5efca7de5bf216844db657cc8acce112204b5f805bd6620d867b8c13821a5
Instruction Fuzzy Hash: 2BA18F32E00619CFCF15DFA5C84499EBBB6FF89304B15817AEA15AB225EB31E905CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Scancontract103.exePID: 1760, Parent PID: 3732COMMON

Execution Graph

Execution Coverage:	16.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.6%
Total number of Nodes:	193
Total number of Limit Nodes:	12

Executed Functions

Function 053D8EC9 Relevance: 1.6, APIs: 1, Instructions: 53nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 053D8F43

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 1a273fb14ec6c9b9ca14de9c4b135b46a5508eb424da10bd15dd68eb05c3b482
Instruction ID: ebd405026db461de8d85728e195e7500d79352953051dd8f91a639b88ad2e139
Opcode Fuzzy Hash: 1a273fb14ec6c9b9ca14de9c4b135b46a5508eb424da10bd15dd68eb05c3b482
Instruction Fuzzy Hash: 0811E4B59042499FCB10DF9AD484BDEFBF8FB48324F10842AE959A7200D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D8ED0 Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL(?,?,?,?), ref: 053D8F43

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: ae3e8eb00064556aa9bffc0a572677d36dfb088a2d137178a75304fe4790e4f6
Instruction ID: 4682389229fcc6eecbdec8b8eeeee8c821cec0f2203ec1dd46d36471168737cc
Opcode Fuzzy Hash: ae3e8eb00064556aa9bffc0a572677d36dfb088a2d137178a75304fe4790e4f6
Instruction Fuzzy Hash: 8011D4B5D042499FCB10DF9AD584BDEFBF8FB48324F10842AE919A7240D779A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145B6C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0145B730
GetCurrentThread.KERNEL32 ref: 0145B76D
GetCurrentProcess.KERNEL32 ref: 0145B7AA
GetCurrentThreadId.KERNEL32 ref: 0145B803

Strings

, xrefs: 0145B82F

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-2740779761
Opcode ID: 2a1fe3a33994136757bfe2bbd71578e6c5179c7e11f76b65a9716038253a07fd
Instruction ID: 80023e44cfe91bcb883405865c26359cb2e8015946345d78fafbe9304c8c55ab
Opcode Fuzzy Hash: 2a1fe3a33994136757bfe2bbd71578e6c5179c7e11f76b65a9716038253a07fd
Instruction Fuzzy Hash: CA5154B4900249CFDB54CFAAD548BEEBBF1FF88314F28846AE409A73A1D7745844CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0145B6D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0145B730
GetCurrentThread.KERNEL32 ref: 0145B76D
GetCurrentProcess.KERNEL32 ref: 0145B7AA
GetCurrentThreadId.KERNEL32 ref: 0145B803

Strings

, xrefs: 0145B82F

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-2740779761
Opcode ID: c37ef8101b3b269168859d126f6d6489cc19d4ab0bccc190d46f22920509c603
Instruction ID: f4320d51261925d7aca35a79d01a0c3d91e2618c640ea609acd1cdbc4ec33c49
Opcode Fuzzy Hash: c37ef8101b3b269168859d126f6d6489cc19d4ab0bccc190d46f22920509c603
Instruction Fuzzy Hash: EE5154B49002098FEB14CFAAD548BDEBBF1FF88314F24846AE419A73A0D7745844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0145FAA0 Relevance: 1.8, APIs: 1, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0145FD0A

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e5878098cdbd2d2ee4e18aa7418e1a36ab32f5f4cd753ee2a0975ad61e2e0b10
Instruction ID: 256bab2aa461bf1dc91c10104613ca7cf0c42f690fda328d3ce320024637f4b6
Opcode Fuzzy Hash: e5878098cdbd2d2ee4e18aa7418e1a36ab32f5f4cd753ee2a0975ad61e2e0b10
Instruction Fuzzy Hash: 14915E718483889FCB06CFA9C8909CDBFB1FF4A314F1981ABE884AB262D7345845CF51

Uniqueness

Uniqueness Score: -1.00%

Function 014593E8 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0145962E

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 627e9e8145408cd2ac14ad33e9eef03248833bbf5c2b5f32045a02c8f842ccf2
Instruction ID: ee6c084b86843545b9da0d9074c7e9a85c6afec3e169850ee5e69a95d6834b5e
Opcode Fuzzy Hash: 627e9e8145408cd2ac14ad33e9eef03248833bbf5c2b5f32045a02c8f842ccf2
Instruction Fuzzy Hash: 10712670A00B058FD764DF6AC44075BBBF1BF89218F008A2ED58AD7B61DB35E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053D1A4C Relevance: 1.7, APIs: 1, Instructions: 185
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(00000000,053D5F31,00020119,00000000,00000000,?), ref: 053D62FF

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 973c90d7a1c22aed4b02332e9a7ebbe42f91dabed4f8c67e70c5a706caa1b183
Instruction ID: 05db5ad40733dae665bf16b22e6388ab6ba064c80db9a5a24f80afd701e3fb6d
Opcode Fuzzy Hash: 973c90d7a1c22aed4b02332e9a7ebbe42f91dabed4f8c67e70c5a706caa1b183
Instruction Fuzzy Hash: 52714771D04209DFDB14CFA9D886BAEFBB1BF48314F148429E825A73A1DB749845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D6136 Relevance: 1.7, APIs: 1, Instructions: 181
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(00000000,053D5F31,00020119,00000000,00000000,?), ref: 053D62FF

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a0c95a8697bb95abbf0caa65d66034cfe1a254a916b1b2f18ed3e5c976513536
Instruction ID: 78e42e1d075114cb3f434cc8423332b48c3b02610dbc12f8fe3df94da76cc835
Opcode Fuzzy Hash: a0c95a8697bb95abbf0caa65d66034cfe1a254a916b1b2f18ed3e5c976513536
Instruction Fuzzy Hash: D5715871D04209DFDB14CFA9D886BAEFBB1BF48314F148429E825AB391DB749885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0145FBF8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0145FD0A

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 36961ea44bdfe3169d5b7148b476687ae62578acd1b868e50f5e43815166c383
Instruction ID: 7401393649b9ab73b0e21189c6ad90a7d2f2dd15fb65a876e6ef24d383cdd41c
Opcode Fuzzy Hash: 36961ea44bdfe3169d5b7148b476687ae62578acd1b868e50f5e43815166c383
Instruction Fuzzy Hash: 7141B1B1D00309DFDB14CF99D884ADEBBB5FF48314F24852AE819AB211D7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 053D1A40 Relevance: 1.6, APIs: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 053D60AF

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 23c9c53b2ce7afb62fe44afe6b783a1dd07f85bd9f36fa98d1b1fde155069fa2
Instruction ID: 21b61f63db5322f00555512366e3d614713bea8941c5cf9dc292a84d61f54b33
Opcode Fuzzy Hash: 23c9c53b2ce7afb62fe44afe6b783a1dd07f85bd9f36fa98d1b1fde155069fa2
Instruction Fuzzy Hash: 7E415671D04358DFCB10CFA9D885B9EFBB5BB48310F14852AE829AB240DBB49845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D5FBC Relevance: 1.6, APIs: 1, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,?,?), ref: 053D60AF

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 1a80ee714b32709c85d8790b77c16dd29c79375f6753d04cadc3405a95a17b6c
Instruction ID: fdac0f882758fdf5d06ecabe8beaab5e0b8666e7daa2f4bbc90c3d06ac5fcce2
Opcode Fuzzy Hash: 1a80ee714b32709c85d8790b77c16dd29c79375f6753d04cadc3405a95a17b6c
Instruction Fuzzy Hash: 804169B2D04358DFCB10CFA9D886B9DFBF1BF48300F14852AE824A7240DBB49845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D8A30 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 053D8B04

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 84680583d0e048d707d6cbb31f3bcb1e7612582f3c1faed36b86c24a3cbc82ad
Instruction ID: e9bba5ba7250085b081b966b52d03f83f28fe3a9b369e1f2597bb5d801af074f
Opcode Fuzzy Hash: 84680583d0e048d707d6cbb31f3bcb1e7612582f3c1faed36b86c24a3cbc82ad
Instruction Fuzzy Hash: 123137B2D102588FDB10CFA9D945B9EFBF5FB48314F148529E815A7240D7B8A846CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D8A26 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(?), ref: 053D8B04

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ea02bf79dea36cc7ba6fad5ae048924ad5f791fb7e551ee277eb395e4ce53005
Instruction ID: 196d64b62577076a7de8e43087534bb79af0ab40f87256645c8802a1606d8464
Opcode Fuzzy Hash: ea02bf79dea36cc7ba6fad5ae048924ad5f791fb7e551ee277eb395e4ce53005
Instruction Fuzzy Hash: EB4137B2D102588FDB10CFA9D985B9DFBF1FB48314F14852AE815A7240D7B8A886CF91

Uniqueness

Uniqueness Score: -1.00%

Function 053D04C8 Relevance: 1.6, APIs: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 053D049D

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 5af9fab3428626652b015f0f64ec02fc01749c8d513d27a58d52ea2fa489a0b7
Instruction ID: 2ccc03b3b964d958269ae6c20d86f3512b7e2720fdc5b4fbf124dcbbb6a458a8
Opcode Fuzzy Hash: 5af9fab3428626652b015f0f64ec02fc01749c8d513d27a58d52ea2fa489a0b7
Instruction Fuzzy Hash: 5F319C75A08208CFDB18CFA9E888BEDBBF1BF49714F1481A9D815A7361D774A844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 053D5A58 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000), ref: 053D642F

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: de316ea5c4d46d1da1eb337b0f1ecf5dcc108e13f28e9e05eb9e1716ba39280d
Instruction ID: 9d684b68eb160c2be1142845f6978687af7592897fca45eb6313da148c4bf1ee
Opcode Fuzzy Hash: de316ea5c4d46d1da1eb337b0f1ecf5dcc108e13f28e9e05eb9e1716ba39280d
Instruction Fuzzy Hash: 0221ECB28083548FEB10DFA9D895BDEBFF4EB59314F50445AC445E7A41D338A840CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0145BCF9 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0145BD87

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b7ae0fda24cef8bf366caf191ded08cf400f6f91feaf94a711bd113256dd37da
Instruction ID: c78b9550370a95707ca7c4db182f3b3e269e897f7f49abc9f4330d45830367d5
Opcode Fuzzy Hash: b7ae0fda24cef8bf366caf191ded08cf400f6f91feaf94a711bd113256dd37da
Instruction Fuzzy Hash: 5621D2B5901208DFDB10CF9AD884BEEBBF9EB48320F14841AE914A7311D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145BD00 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0145BD87

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b61532eeff649457408b67387c1f84c1a0f0a0070b161d727c10cb910942b7f2
Instruction ID: b495075b3b38ef858c3acf60bff465099acc3c8460f37b046515ce567a31c9e2
Opcode Fuzzy Hash: b61532eeff649457408b67387c1f84c1a0f0a0070b161d727c10cb910942b7f2
Instruction Fuzzy Hash: F021B3B59002099FDB10CF9AD984BDEBBF9EB48324F14841AE954A7350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01459849 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014596A9,00000800,00000000,00000000), ref: 014598BA

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3bdcdc40abccecb8802421cfe88e8b5cd445f1f6299da1da019ef10572382948
Instruction ID: e75cdcd3c5113db6a239770b2e81d8778b235f6349390f6dd95c9379ec70405c
Opcode Fuzzy Hash: 3bdcdc40abccecb8802421cfe88e8b5cd445f1f6299da1da019ef10572382948
Instruction Fuzzy Hash: B621F2B6800209DFDB10CF9AD844BDEFBF4AB88314F14842AD915A7610C778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01458768 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014596A9,00000800,00000000,00000000), ref: 014598BA

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1804853b904e9d6db460007e56e728ac22a3adc9ec9f28d84f488194525ed251
Instruction ID: 38d81d9ee120b99809ef8870e2bafb0c540020513251f487bcdeedfc59d2706f
Opcode Fuzzy Hash: 1804853b904e9d6db460007e56e728ac22a3adc9ec9f28d84f488194525ed251
Instruction Fuzzy Hash: EC11C2B6904209DFDB10CF9AD444BDEBBF4EB88324F14842AE919A7610C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0145FE38 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0145FE9D

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d23a99887e7590f8e693423d7a854ca77e53a82ff99e973f14e741da1325b362
Instruction ID: dd18f85dde6dfba19d71774e00030ae954de1a935f62f7ede1a8fd85ea6b4847
Opcode Fuzzy Hash: d23a99887e7590f8e693423d7a854ca77e53a82ff99e973f14e741da1325b362
Instruction Fuzzy Hash: EB1125B5800249CFDB10CF99D585BDEBBF8EB48324F20841AD854B7201C379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014595C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0145962E

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3834431282431c604a4278bd23ecc6675d2fdb97c39e698e19f1ce26ab6ceb69
Instruction ID: cb312b001df0045659584a09668140b245b8ce11cc5aa0b261e8f8be0d1fa690
Opcode Fuzzy Hash: 3834431282431c604a4278bd23ecc6675d2fdb97c39e698e19f1ce26ab6ceb69
Instruction Fuzzy Hash: 7011E0B6C00249CFDB10CF9AD444BDFFBF8EB88224F14842AD819A7610D379A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D0438 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 053D049D

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 013aa2ae8b7c751cbd0faf01a3f0bdf33992e11043456106cf79c6d73963ed63
Instruction ID: 93054c1a86afdfeb43e29e88a3adf2ce1fea3ca02e258aa1c525249b74d299c7
Opcode Fuzzy Hash: 013aa2ae8b7c751cbd0faf01a3f0bdf33992e11043456106cf79c6d73963ed63
Instruction Fuzzy Hash: 5311F5B5C046498FCB14CF9AE544BEEFBF4BB48324F10852AD429A7350D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D5A48 Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000), ref: 053D642F

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d4edb1ddf14e5c6e3c2ef747c9bc23b6419b87af742e5026b0790b0aa8299d17
Instruction ID: 4abd008fa557ebf85cec892db1eccfc03b080bcd5a15c7ae18d34498de8a5223
Opcode Fuzzy Hash: d4edb1ddf14e5c6e3c2ef747c9bc23b6419b87af742e5026b0790b0aa8299d17
Instruction Fuzzy Hash: C11118B5804249CFDB10CF9AD445BDEFBF8EB48324F508419D519A7640D7B5A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145FE40 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0145FE9D

Memory Dump Source

Source File: 00000006.00000002.528783561.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1450000_Scancontract103.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 35e5480a7f0c80dbf9b9dbeed4630c824a8c57ad5ebc15c9b0b37a2954a77020
Instruction ID: 23414c6ddf79022579517b1048fc58f924ba89bd17706c93c8f6ce403ba3c19c
Opcode Fuzzy Hash: 35e5480a7f0c80dbf9b9dbeed4630c824a8c57ad5ebc15c9b0b37a2954a77020
Instruction Fuzzy Hash: 4911E5B5800249DFDB10CF99D585BDFBBF8EB48324F10841AD915A7741D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D63CA Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000), ref: 053D642F

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 035c975a90912604145638fd842cb9ab8037ba2dbcea8132e47e74d38c321656
Instruction ID: c7118f50957ceda2cad495d7f45bff8a6c0081b69473d2af5b722993faac2c62
Opcode Fuzzy Hash: 035c975a90912604145638fd842cb9ab8037ba2dbcea8132e47e74d38c321656
Instruction Fuzzy Hash: 411115B58042498FDB10CF9AD485BDEFBF8EB48324F108419D519A7240D779A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053D0440 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 053D049D

Memory Dump Source

Source File: 00000006.00000002.547493432.00000000053D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_Scancontract103.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: daa2e9c4d82edfb1573636bcf8019ff47637074ed948f3ea75f8fe622e8507e6
Instruction ID: e6906ecdea843b25dae6c4b358a49543e6d9c63a0cbc18d819fcfec790f1f0c4
Opcode Fuzzy Hash: daa2e9c4d82edfb1573636bcf8019ff47637074ed948f3ea75f8fe622e8507e6
Instruction Fuzzy Hash: B811D0B5C046498FDB14CF9AE548BDEFBF8EB48324F10852AD419A7240D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527081472.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_101d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e62f594553650df1323eb4435af4b6042597fdecfb6d97c6b1b9402700667c
Instruction ID: 08fc684cb98c0db06aa7b6db400a2c6055c90b98aa2f5ae8958bda1070d62267
Opcode Fuzzy Hash: 50e62f594553650df1323eb4435af4b6042597fdecfb6d97c6b1b9402700667c
Instruction Fuzzy Hash: F42128B1544240DFDB01CF94D8C4B2ABFA5FB88328F24C5A9E9454B20AC77AD856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527081472.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_101d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d682c09122b55ec2d273ecc196588fc3994d79dd9cd9185ae88ee98f0c7f9175
Instruction ID: 536c0d1cbe160b5649b5476da52a1c15c5d6a14e291f9d85d7541ac9dcc421af
Opcode Fuzzy Hash: d682c09122b55ec2d273ecc196588fc3994d79dd9cd9185ae88ee98f0c7f9175
Instruction Fuzzy Hash: 2E2167B1544200DFDB01CF94D8C8B6BBFA5FB88324F20C5A9E9454B20BC73AE856C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0110D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527276305.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcb839d5621765ece0ac3e38cadcfcfa29f3d28f88474d12bdcc80c1fc680c8
Instruction ID: d8b48a344f87dfcd456b24e80329e00be1a2e3810d5d8a1e14942e5097293290
Opcode Fuzzy Hash: 5bcb839d5621765ece0ac3e38cadcfcfa29f3d28f88474d12bdcc80c1fc680c8
Instruction Fuzzy Hash: B0212871908204DFDF1ACF94E8C0B16BB65FB84354F20C569D90D4B28AC7B6D807CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0101D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527081472.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_101d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction ID: c751595411f1a4efb2372e9a9639b125b7bd8aa7c2af7a78531ee9c2f718e989
Opcode Fuzzy Hash: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction Fuzzy Hash: B311B176804280CFDB12CF54D5C4B16BFB1FB84324F2486A9D9450B65BC33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0101D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527081472.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_101d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction ID: c42b3d1cda1f3c944ec18796aeb733f5823bc4d4df9db6af65938ac0171000c6
Opcode Fuzzy Hash: cd24c802d1f0944178af6fc850af7be5c5916ca1db69a1141699bdd4730e3d2e
Instruction Fuzzy Hash: 8011B176444280CFCB16CF54D5C4B56BFB1FB84324F24C6A9D8450B65AC33AE456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0110D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.527276305.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_110d000_Scancontract103.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fd11be75d3965515b4152d8e08f00d09ff848862d85c063b28ddaa4755cdb2
Instruction ID: b00227e7343b882da5d9214faae6f7ed3d71b5e6518b9b1f69b87962a1521ad1
Opcode Fuzzy Hash: b4fd11be75d3965515b4152d8e08f00d09ff848862d85c063b28ddaa4755cdb2
Instruction Fuzzy Hash: 5611D075904280CFCB16CF54E5C4B15FF71FB44324F24C6AAD8094B69AC37AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scancontract103.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

C:\Users\user\AppData\Local\Temp\tmp1090.tmp

C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Static File Info

Windows Analysis Report
Scancontract103.exe