Edit tour

Windows Analysis Report
Scancontract103.exe

Overview

General Information

Sample Name:	Scancontract103.exe
Analysis ID:	713039
MD5:	9d2a2b596cd979fc9674824d2aa731df
SHA1:	015e8ae0f838e0fba35643297530a5b9a66e4186
SHA256:	c4a2c953833c8d6b5d2ef71b997700559ecc9f23573d89072d205f963e46956c
Tags:	exeNanoCoreRAT
Infos:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected AntiVM3

Detected Nanocore Rat

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for domain / URL

Yara detected Nanocore RAT

Protects its processes via BreakOnTermination flag

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large strings

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Scancontract103.exe (PID: 3732 cmdline: "C:\Users\user\Desktop\Scancontract103.exe" MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 1760 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

schtasks.exe (PID: 2636 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 2300 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Scancontract103.exe (PID: 6052 cmdline: C:\Users\user\Desktop\Scancontract103.exe 0 MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 3988 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

Scancontract103.exe (PID: 5588 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 5308 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 4632 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 2576 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 1012 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 2300 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 5420 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

dhcpmon.exe (PID: 408 cmdline: {path} MD5: 9D2A2B596CD979FC9674824D2AA731DF)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "c5cb65e3-79c3-43dc-bde0-43ed679c", "Group": "Default", "Domain1": "79.134.225.6", "Domain2": "", "Port": 60110, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xff8d:$a1: NanoCore.ClientPluginHost 0xff4d:$a2: NanoCore.ClientPlugin 0x11ea6:$b1: get_BuilderSettings 0xfda9:$b2: ClientLoaderForm.resources 0x115c6:$b3: PluginCommand 0xff7e:$b4: IClientAppHost 0x1a3fe:$b5: GetBlockHash 0x124fe:$b6: AddHostEntry 0x161f1:$b7: LogClientException 0x1246b:$b8: PipeExists 0xffb7:$b9: IClientLoggingHost
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x4359d:$a: NanoCore 0x435f6:$a: NanoCore 0x43633:$a: NanoCore 0x436ac:$a: NanoCore 0x56d57:$a: NanoCore 0x56d6c:$a: NanoCore 0x56da1:$a: NanoCore 0x6fd2b:$a: NanoCore 0x6fd40:$a: NanoCore 0x6fd75:$a: NanoCore 0x435ff:$b: ClientPlugin 0x4363c:$b: ClientPlugin 0x43f3a:$b: ClientPlugin 0x43f47:$b: ClientPlugin 0x56b13:$b: ClientPlugin 0x56b2e:$b: ClientPlugin 0x56b5e:$b: ClientPlugin 0x56d75:$b: ClientPlugin 0x56daa:$b: ClientPlugin 0x6fae7:$b: ClientPlugin 0x6fb02:$b: ClientPlugin
00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x43633:$a1: NanoCore.ClientPluginHost 0x56da1:$a1: NanoCore.ClientPluginHost 0x6fd75:$a1: NanoCore.ClientPluginHost 0x435f6:$a2: NanoCore.ClientPlugin 0x56d6c:$a2: NanoCore.ClientPlugin 0x6fd40:$a2: NanoCore.ClientPlugin 0x439ca:$b1: get_BuilderSettings 0x5bce7:$b1: get_BuilderSettings 0x74cbb:$b1: get_BuilderSettings 0x43681:$b4: IClientAppHost 0x43a3b:$b6: AddHostEntry 0x43aaa:$b7: LogClientException 0x5bc56:$b7: LogClientException 0x74c2a:$b7: LogClientException 0x43a1f:$b8: PipeExists 0x4366e:$b9: IClientLoggingHost 0x56dbb:$b9: IClientLoggingHost 0x6fd8f:$b9: IClientLoggingHost
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd06dd:$x1: NanoCore.ClientPluginHost 0xd071a:$x2: IClientNetworkHost 0xd424d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xd0445:$a: NanoCore 0xd0455:$a: NanoCore 0xd0689:$a: NanoCore 0xd069d:$a: NanoCore 0xd06dd:$a: NanoCore 0xd04a4:$b: ClientPlugin 0xd06a6:$b: ClientPlugin 0xd06e6:$b: ClientPlugin 0xd05cb:$c: ProjectData 0xd0fd2:$d: DESCrypto 0xd899e:$e: KeepAlive 0xd698c:$g: LogClientMessage 0xd2b87:$i: get_Connected 0xd1308:$j: #=q 0xd1338:$j: #=q 0xd1354:$j: #=q 0xd1384:$j: #=q 0xd13a0:$j: #=q 0xd13bc:$j: #=q 0xd13ec:$j: #=q 0xd1408:$j: #=q
00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd06dd:$a1: NanoCore.ClientPluginHost 0xd069d:$a2: NanoCore.ClientPlugin 0xd25f6:$b1: get_BuilderSettings 0xd04f9:$b2: ClientLoaderForm.resources 0xd1d16:$b3: PluginCommand 0xd06ce:$b4: IClientAppHost 0xdab4e:$b5: GetBlockHash 0xd2c4e:$b6: AddHostEntry 0xd6941:$b7: LogClientException 0xd2bbb:$b8: PipeExists 0xd0707:$b9: IClientLoggingHost
00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x2d0c9:$a1: NanoCore.ClientPluginHost 0x2d08c:$a2: NanoCore.ClientPlugin 0x2d460:$b1: get_BuilderSettings 0x2d117:$b4: IClientAppHost 0x2d4d1:$b6: AddHostEntry 0x2d540:$b7: LogClientException 0x2d4b5:$b8: PipeExists 0x2d104:$b9: IClientLoggingHost
00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69437:$a: NanoCore 0x69490:$a: NanoCore 0x694cd:$a: NanoCore 0x69546:$a: NanoCore 0x69499:$b: ClientPlugin 0x694d6:$b: ClientPlugin 0x69dd4:$b: ClientPlugin 0x69de1:$b: ClientPlugin 0x5f59f:$e: KeepAlive 0x69921:$g: LogClientMessage 0x698a1:$i: get_Connected 0x5986d:$j: #=q 0x5989d:$j: #=q 0x598d9:$j: #=q 0x59901:$j: #=q 0x59931:$j: #=q 0x59961:$j: #=q 0x59991:$j: #=q 0x599c1:$j: #=q 0x599dd:$j: #=q 0x59a0d:$j: #=q
00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x694cd:$a1: NanoCore.ClientPluginHost 0x69490:$a2: NanoCore.ClientPlugin 0x5ada7:$b1: get_BuilderSettings 0x69864:$b1: get_BuilderSettings 0x6951b:$b4: IClientAppHost 0x698d5:$b6: AddHostEntry 0x5ad16:$b7: LogClientException 0x69944:$b7: LogClientException 0x698b9:$b8: PipeExists 0x69508:$b9: IClientLoggingHost
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1a011d:$x1: NanoCore.ClientPluginHost 0x1a015a:$x2: IClientNetworkHost 0x1a3c8d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x19fe85:$a: NanoCore 0x19fe95:$a: NanoCore 0x1a00c9:$a: NanoCore 0x1a00dd:$a: NanoCore 0x1a011d:$a: NanoCore 0x19fee4:$b: ClientPlugin 0x1a00e6:$b: ClientPlugin 0x1a0126:$b: ClientPlugin 0x1a000b:$c: ProjectData 0x289e10:$c: ProjectData 0x1a0a12:$d: DESCrypto 0x1a83de:$e: KeepAlive 0x1a63cc:$g: LogClientMessage 0x1a25c7:$i: get_Connected 0x1a0d48:$j: #=q 0x1a0d78:$j: #=q 0x1a0d94:$j: #=q 0x1a0dc4:$j: #=q 0x1a0de0:$j: #=q 0x1a0dfc:$j: #=q 0x1a0e2c:$j: #=q
00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1a011d:$a1: NanoCore.ClientPluginHost 0x1a00dd:$a2: NanoCore.ClientPlugin 0x1a2036:$b1: get_BuilderSettings 0x19ff39:$b2: ClientLoaderForm.resources 0x1a1756:$b3: PluginCommand 0x1a010e:$b4: IClientAppHost 0x1aa58e:$b5: GetBlockHash 0x1a268e:$b6: AddHostEntry 0x1a6381:$b7: LogClientException 0x1a25fb:$b8: PipeExists 0x1a0147:$b9: IClientLoggingHost
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x69383:$a: NanoCore 0x693dc:$a: NanoCore 0x69419:$a: NanoCore 0x69492:$a: NanoCore 0x693e5:$b: ClientPlugin 0x69422:$b: ClientPlugin 0x69d20:$b: ClientPlugin 0x69d2d:$b: ClientPlugin 0x5f4eb:$e: KeepAlive 0x6986d:$g: LogClientMessage 0x697ed:$i: get_Connected 0x597b9:$j: #=q 0x597e9:$j: #=q 0x59825:$j: #=q 0x5984d:$j: #=q 0x5987d:$j: #=q 0x598ad:$j: #=q 0x598dd:$j: #=q 0x5990d:$j: #=q 0x59929:$j: #=q 0x59959:$j: #=q
00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x69419:$a1: NanoCore.ClientPluginHost 0x693dc:$a2: NanoCore.ClientPlugin 0x5acf3:$b1: get_BuilderSettings 0x697b0:$b1: get_BuilderSettings 0x69467:$b4: IClientAppHost 0x69821:$b6: AddHostEntry 0x5ac62:$b7: LogClientException 0x69890:$b7: LogClientException 0x69805:$b8: PipeExists 0x69454:$b9: IClientLoggingHost
Process Memory Space: Scancontract103.exe PID: 3732	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf3dc7:$x1: NanoCore.ClientPluginHost 0x15971a:$x1: NanoCore.ClientPluginHost 0xf3e04:$x2: IClientNetworkHost 0x159757:$x2: IClientNetworkHost 0xf78f5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x10297b:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x15cebc:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x167e28:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Scancontract103.exe PID: 3732	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0xef1c1:$s5: AEAAAAMAAQqVT 0x4b1cf:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xcc3fb:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xef132:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: Scancontract103.exe PID: 3732	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Scancontract103.exe PID: 3732	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 3732	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf3a94:$a: NanoCore 0xf3aa4:$a: NanoCore 0xf3b63:$a: NanoCore 0xf3b72:$a: NanoCore 0xf3d73:$a: NanoCore 0xf3d87:$a: NanoCore 0xf3dc7:$a: NanoCore 0xfefe5:$a: NanoCore 0xfeff7:$a: NanoCore 0xff033:$a: NanoCore 0x159431:$a: NanoCore 0x159441:$a: NanoCore 0x1594b6:$a: NanoCore 0x1594c5:$a: NanoCore 0x1596c6:$a: NanoCore 0x1596da:$a: NanoCore 0x15971a:$a: NanoCore 0x164492:$a: NanoCore 0x1644a4:$a: NanoCore 0x1644e0:$a: NanoCore 0xf3af3:$b: ClientPlugin
Process Memory Space: Scancontract103.exe PID: 3732	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf3dc7:$a1: NanoCore.ClientPluginHost 0x15971a:$a1: NanoCore.ClientPluginHost 0xf3d87:$a2: NanoCore.ClientPlugin 0x1596da:$a2: NanoCore.ClientPlugin 0xf5c9e:$b1: get_BuilderSettings 0x15b26c:$b1: get_BuilderSettings 0xf3b48:$b2: ClientLoaderForm.resources 0x15949b:$b2: ClientLoaderForm.resources 0xf53be:$b3: PluginCommand 0x15a9a2:$b3: PluginCommand 0xf3db8:$b4: IClientAppHost 0x15970b:$b4: IClientAppHost 0xfe1f1:$b5: GetBlockHash 0x1637b8:$b5: GetBlockHash 0xf62f6:$b6: AddHostEntry 0x101415:$b6: AddHostEntry 0x15b8bd:$b6: AddHostEntry 0x1668c2:$b6: AddHostEntry 0xf9fe9:$b7: LogClientException 0x104f56:$b7: LogClientException 0x15f5b0:$b7: LogClientException
Process Memory Space: Scancontract103.exe PID: 1760	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x21dc1:$x1: NanoCore.ClientPluginHost 0x41b5d:$x1: NanoCore.ClientPluginHost 0x21dfe:$x2: IClientNetworkHost 0x41b77:$x2: IClientNetworkHost 0x258ef:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x30975:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Scancontract103.exe PID: 1760	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 1760	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xc1e8:$a: NanoCore 0x21a8e:$a: NanoCore 0x21a9e:$a: NanoCore 0x21b5d:$a: NanoCore 0x21b6c:$a: NanoCore 0x21d6d:$a: NanoCore 0x21d81:$a: NanoCore 0x21dc1:$a: NanoCore 0x2cfdf:$a: NanoCore 0x2cff1:$a: NanoCore 0x2d02d:$a: NanoCore 0x38066:$a: NanoCore 0x380c1:$a: NanoCore 0x38134:$a: NanoCore 0x41ac7:$a: NanoCore 0x41b20:$a: NanoCore 0x41b5d:$a: NanoCore 0x41bd6:$a: NanoCore 0x42480:$a: NanoCore 0x424d3:$a: NanoCore 0x4250c:$a: NanoCore
Process Memory Space: Scancontract103.exe PID: 1760	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x21dc1:$a1: NanoCore.ClientPluginHost 0x41b5d:$a1: NanoCore.ClientPluginHost 0x21d81:$a2: NanoCore.ClientPlugin 0x41b20:$a2: NanoCore.ClientPlugin 0x23c98:$b1: get_BuilderSettings 0x41ed7:$b1: get_BuilderSettings 0x21b42:$b2: ClientLoaderForm.resources 0x233b8:$b3: PluginCommand 0x21db2:$b4: IClientAppHost 0x41bab:$b4: IClientAppHost 0x2c1eb:$b5: GetBlockHash 0x242f0:$b6: AddHostEntry 0x2f40f:$b6: AddHostEntry 0x41f48:$b6: AddHostEntry 0x27fe3:$b7: LogClientException 0x32f50:$b7: LogClientException 0x41fb7:$b7: LogClientException 0x2425d:$b8: PipeExists 0x2f383:$b8: PipeExists 0x41f2c:$b8: PipeExists 0x21deb:$b9: IClientLoggingHost
Process Memory Space: Scancontract103.exe PID: 6052	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x14125:$s5: AEAAAAMAAQqVT 0x8217:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x14096:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: dhcpmon.exe PID: 5308	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x1e768:$s5: AEAAAAMAAQqVT 0x1e6d9:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x24032:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: dhcpmon.exe PID: 5308	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dhcpmon.exe PID: 1012	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth	0x1359f:$s5: AEAAAAMAAQqVT 0x13510:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x16593:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: Scancontract103.exe PID: 5588	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scancontract103.exe PID: 5588	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3296:$a: NanoCore 0x32ef:$a: NanoCore 0x332c:$a: NanoCore 0x33a5:$a: NanoCore 0x3c5e:$a: NanoCore 0x3cb1:$a: NanoCore 0x3cea:$a: NanoCore 0x3d5d:$a: NanoCore 0xb32f:$a: NanoCore 0xb342:$a: NanoCore 0xb374:$a: NanoCore 0x1104a:$a: NanoCore 0x1105d:$a: NanoCore 0x1108f:$a: NanoCore 0x17f59:$a: NanoCore 0x17fb4:$a: NanoCore 0x18028:$a: NanoCore 0x2d537:$a: NanoCore 0x2d590:$a: NanoCore 0x2d5cd:$a: NanoCore 0x2d646:$a: NanoCore
Process Memory Space: Scancontract103.exe PID: 5588	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x332c:$a1: NanoCore.ClientPluginHost 0x2d5cd:$a1: NanoCore.ClientPluginHost 0x32ef:$a2: NanoCore.ClientPlugin 0x2d590:$a2: NanoCore.ClientPlugin 0x36a6:$b1: get_BuilderSettings 0x26ce9:$b1: get_BuilderSettings 0x337a:$b4: IClientAppHost 0x2d61b:$b4: IClientAppHost 0x3717:$b6: AddHostEntry 0x2d92e:$b6: AddHostEntry 0x3786:$b7: LogClientException 0x26c58:$b7: LogClientException 0x36fb:$b8: PipeExists 0x2d912:$b8: PipeExists 0x3367:$b9: IClientLoggingHost 0x2d608:$b9: IClientLoggingHost
Process Memory Space: dhcpmon.exe PID: 2576	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: dhcpmon.exe PID: 2576	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x36de:$a: NanoCore 0x5d51:$a: NanoCore 0x5dac:$a: NanoCore 0x5e20:$a: NanoCore 0x1b2bd:$a: NanoCore 0x1b316:$a: NanoCore 0x1b353:$a: NanoCore 0x1b3cc:$a: NanoCore 0x1bb5a:$a: NanoCore 0x1bbad:$a: NanoCore 0x1bbe6:$a: NanoCore 0x1bc59:$a: NanoCore 0x1c756:$a: NanoCore 0x165e8:$b: ClientPlugin 0x16629:$b: ClientPlugin 0x1b31f:$b: ClientPlugin 0x1b35c:$b: ClientPlugin 0x1bb0a:$b: ClientPlugin 0x1bb17:$b: ClientPlugin 0x1bbb6:$b: ClientPlugin 0x1bbef:$b: ClientPlugin
Process Memory Space: dhcpmon.exe PID: 2576	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1b353:$a1: NanoCore.ClientPluginHost 0x1b316:$a2: NanoCore.ClientPlugin 0x14a70:$b1: get_BuilderSettings 0x1b3a1:$b4: IClientAppHost 0x1b6b4:$b6: AddHostEntry 0x149df:$b7: LogClientException 0x1b698:$b8: PipeExists 0x1b38e:$b9: IClientLoggingHost
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
20.2.Scancontract103.exe.33695a4.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
20.2.Scancontract103.exe.33695a4.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
21.2.dhcpmon.exe.2dc9658.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5b7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5e4:$x2: IClientNetworkHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5b7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e692:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5d1:$s5: IClientLoggingHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.434b7be.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d582:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d5b7:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d576:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d598:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d5a7:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d5d1:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
20.2.Scancontract103.exe.434b7be.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d56d:$a: NanoCore 0x2d582:$a: NanoCore 0x2d5b7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d329:$b: ClientPlugin 0x2d344:$b: ClientPlugin
20.2.Scancontract103.exe.434b7be.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0x145e3:$a1: NanoCore.ClientPluginHost 0x2d5b7:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x145ae:$a2: NanoCore.ClientPlugin 0x2d582:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0x19529:$b1: get_BuilderSettings 0x324fd:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x19498:$b7: LogClientException 0x3246c:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost 0x145fd:$b9: IClientLoggingHost 0x2d5d1:$b9: IClientLoggingHost
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
6.2.Scancontract103.exe.2e4d254.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5900000.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
6.2.Scancontract103.exe.5900000.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5910000.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5910000.4.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
6.2.Scancontract103.exe.5910000.4.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5910000.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5910000.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
6.2.Scancontract103.exe.5910000.4.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
6.0.Scancontract103.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.0.Scancontract103.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.0.Scancontract103.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.0.Scancontract103.exe.400000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
6.0.Scancontract103.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
6.0.Scancontract103.exe.400000.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
6.2.Scancontract103.exe.5914629.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.Scancontract103.exe.5914629.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
6.2.Scancontract103.exe.5914629.5.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.3631550.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.3631550.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
0.2.Scancontract103.exe.3631550.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.Scancontract103.exe.3631550.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28781:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287ae:$x2: IClientNetworkHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28781:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2985c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2879b:$s5: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.43505f4.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x2874c:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28781:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28740:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x28762:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28771:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x2879b:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x287ae:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x287c1:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x287cf:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x287eb:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
20.2.Scancontract103.exe.43505f4.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0x28781:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x2874c:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x2d6c7:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0x2d636:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost 0x2879b:$b9: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.3631550.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Scancontract103.exe.3631550.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.3631550.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe0f5:$x1: NanoCore Client 0xe105:$x1: NanoCore Client 0xe34d:$x2: NanoCore.ClientPlugin 0xe38d:$x3: NanoCore.ClientPluginHost 0xe342:$i1: IClientApp 0xe363:$i2: IClientData 0xe36f:$i3: IClientNetwork 0xe37e:$i4: IClientAppHost 0xe3a7:$i5: IClientDataHost 0xe3b7:$i6: IClientLoggingHost 0xe3ca:$i7: IClientNetworkHost 0xe3dd:$i8: IClientUIHost 0xe3eb:$i9: IClientNameObjectCollection 0xe407:$i10: IClientReadOnlyNameObjectCollection 0xe154:$s1: ClientPlugin 0xe356:$s1: ClientPlugin 0xe84a:$s2: EndPoint 0xe853:$s3: IPAddress 0xe85d:$s4: IPEndPoint 0x10293:$s6: get_ClientSettings 0x10837:$s7: get_Connected
0.2.Scancontract103.exe.3631550.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
0.2.Scancontract103.exe.3631550.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe38d:$a1: NanoCore.ClientPluginHost 0xe34d:$a2: NanoCore.ClientPlugin 0x102a6:$b1: get_BuilderSettings 0xe1a9:$b2: ClientLoaderForm.resources 0xf9c6:$b3: PluginCommand 0xe37e:$b4: IClientAppHost 0x187fe:$b5: GetBlockHash 0x108fe:$b6: AddHostEntry 0x145f1:$b7: LogClientException 0x1086b:$b8: PipeExists 0xe3b7:$b9: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
20.2.Scancontract103.exe.43505f4.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
20.2.Scancontract103.exe.43505f4.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.43505f4.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
20.2.Scancontract103.exe.43505f4.3.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xbd71d:$x1: NanoCore.ClientPluginHost 0xbd75a:$x2: IClientNetworkHost 0xc128d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xbd485:$x1: NanoCore Client 0xbd495:$x1: NanoCore Client 0xbd6dd:$x2: NanoCore.ClientPlugin 0xbd71d:$x3: NanoCore.ClientPluginHost 0xbd6d2:$i1: IClientApp 0xbd6f3:$i2: IClientData 0xbd6ff:$i3: IClientNetwork 0xbd70e:$i4: IClientAppHost 0xbd737:$i5: IClientDataHost 0xbd747:$i6: IClientLoggingHost 0xbd75a:$i7: IClientNetworkHost 0xbd76d:$i8: IClientUIHost 0xbd77b:$i9: IClientNameObjectCollection 0xbd797:$i10: IClientReadOnlyNameObjectCollection 0xbd4e4:$s1: ClientPlugin 0xbd6e6:$s1: ClientPlugin 0xbdbda:$s2: EndPoint 0xbdbe3:$s3: IPAddress 0xbdbed:$s4: IPEndPoint 0xbf623:$s6: get_ClientSettings 0xbfbc7:$s7: get_Connected
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xbd485:$a: NanoCore 0xbd495:$a: NanoCore 0xbd6c9:$a: NanoCore 0xbd6dd:$a: NanoCore 0xbd71d:$a: NanoCore 0xbd4e4:$b: ClientPlugin 0xbd6e6:$b: ClientPlugin 0xbd726:$b: ClientPlugin 0xbd60b:$c: ProjectData 0x1a7410:$c: ProjectData 0xbe012:$d: DESCrypto 0xc59de:$e: KeepAlive 0xc39cc:$g: LogClientMessage 0xbfbc7:$i: get_Connected 0xbe348:$j: #=q 0xbe378:$j: #=q 0xbe394:$j: #=q 0xbe3c4:$j: #=q 0xbe3e0:$j: #=q 0xbe3fc:$j: #=q 0xbe42c:$j: #=q
0.2.Scancontract103.exe.37a0a00.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xbd71d:$a1: NanoCore.ClientPluginHost 0xbd6dd:$a2: NanoCore.ClientPlugin 0xbf636:$b1: get_BuilderSettings 0xbd539:$b2: ClientLoaderForm.resources 0xbed56:$b3: PluginCommand 0xbd70e:$b4: IClientAppHost 0xc7b8e:$b5: GetBlockHash 0xbfc8e:$b6: AddHostEntry 0xc3981:$b7: LogClientException 0xbfbfb:$b8: PipeExists 0xbd747:$b9: IClientLoggingHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24158:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x24185:$x2: IClientNetworkHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24158:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x25233:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x24172:$s5: IClientLoggingHost
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x24123:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x24158:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x24117:$i2: IClientData 0xb165:$i3: IClientNetwork 0x24139:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x24148:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x24172:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x24185:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x24198:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x241a6:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x241c2:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
20.2.Scancontract103.exe.4354c1d.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0x24158:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x24123:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x2909e:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0x2900d:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost 0x24172:$b9: IClientLoggingHost
Click to see the 69 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\Scancontract103.exe, ParentProcessId: 1760, ParentProcessName: Scancontract103.exe, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp, ProcessId: 2636, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Scancontract103.exe, ProcessId: 1760, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Scancontract103.exe

Virustotal: Detection: 40%

Perma Link

Multi AV Scanner detection for domain / URL

Source: 79.134.225.6

Virustotal: Detection: 6%

Perma Link

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Machine Learning detection for sample

Source: Scancontract103.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox ML: detected

Source: 6.0.Scancontract103.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.Scancontract103.exe.5910000.4.unpack	Avira: Label: TR/NanoCore.fadte

Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "c5cb65e3-79c3-43dc-bde0-43ed679c", "Group": "Default", "Domain1": "79.134.225.6", "Domain2": "", "Port": 60110, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Source: Scancontract103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Scancontract103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: 79.134.225.6

Source: Joe Sandbox View

ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH

Source: Joe Sandbox View

IP Address: 79.134.225.6 79.134.225.6

Source: global traffic

TCP traffic: 192.168.2.3:49707 -> 79.134.225.6:60110

Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6
Source: unknown	TCP traffic detected without corresponding DNS query: 79.134.225.6

Source: Scancontract103.exe, 00000000.00000003.265302103.000000000598D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.wikip
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Scancontract103.exe, 00000000.00000003.266935495.0000000005989000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Scancontract103.exe, 00000000.00000003.269009492.00000000059C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commv
Source: Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Scancontract103.exe, 00000000.00000003.260309270.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comc
Source: Scancontract103.exe, 00000000.00000003.263528849.0000000005986000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263806579.000000000598E000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cna-d
Source: Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cntyp9
Source: Scancontract103.exe, 00000000.00000003.272557005.00000000059C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Scancontract103.exe, 00000000.00000003.266747836.00000000059C6000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: dhcpmon.exe, 00000010.00000002.390909200.00000000016B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\Scancontract103.exe

Process information set: 01 00 00 00

System Summary

Malicious sample detected (through community Yara rule)

Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown

.NET source code contains very large strings

Source: Scancontract103.exe, FrmMain.cs	Long String: Length: 129663
Source: 0.0.Scancontract103.exe.170000.0.unpack, FrmMain.cs	Long String: Length: 129663
Source: dhcpmon.exe.6.dr, FrmMain.cs	Long String: Length: 129663

Source: Scancontract103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.33695a4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 21.2.dhcpmon.exe.2dc9658.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.2e4d254.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5900000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: Scancontract103.exe PID: 6052, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: dhcpmon.exe PID: 5308, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: dhcpmon.exe PID: 1012, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, hash1 = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, author = Florian Roth, description = Detects an base64 encoded executable with reversed characters, score = file, reference = Internal Research
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 0_2_049FD4B4
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145E471
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145E480
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_0145BBD4
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D6550
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DD4E8
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D3E30
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DC8D0
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D4A50
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053DD5A6
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D4B08

Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D8ED0 NtSetInformationProcess,
Source: C:\Users\user\Desktop\Scancontract103.exe	Code function: 6_2_053D8EC9 NtSetInformationProcess,

Source: Scancontract103.exe, 00000000.00000000.254620443.0000000000172000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename8voN7Es.exe: vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.326192763.00000000075A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000000.00000002.325921725.00000000073F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.546358238.0000000003EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000006.00000002.548456934.0000000006360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 0000000F.00000002.398015480.000000000438A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQuestKingdom.dllH vs Scancontract103.exe
Source: Scancontract103.exe, 0000000F.00000002.398402298.0000000004519000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs Scancontract103.exe
Source: Scancontract103.exe	Binary or memory string: OriginalFilename8voN7Es.exe: vs Scancontract103.exe

Source: Scancontract103.exe

Virustotal: Detection: 40%

Source: C:\Users\user\Desktop\Scancontract103.exe

File read: C:\Users\user\Desktop\Scancontract103.exe

Jump to behavior

Source: Scancontract103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Scancontract103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\Scancontract103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@26/8@0/1

Source: Scancontract103.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\Scancontract103.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5056:120:WilError_01
Source: C:\Users\user\Desktop\Scancontract103.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{c5cb65e3-79c3-43dc-bde0-43ed679c8c9b}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4744:120:WilError_01

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: Scancontract103.exe, 00000000.00000003.275810844.000000000598C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: DITC Blackadder is a Trademark of International Typeface Corporation.slnt

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Scancontract103.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: Scancontract103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Scancontract103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: Scancontract103.exe, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)
Source: 0.0.Scancontract103.exe.170000.0.unpack, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)
Source: dhcpmon.exe.6.dr, FrmMain.cs	.Net Code: NewLateBinding.LateCall(V_1, null, "Invoke", stackVariable12, null, null, null, true)

Source: C:\Users\user\Desktop\Scancontract103.exe

Code function: 6_2_053DFC4A push FFFFFFE0h; ret

Source: initial sample	Static PE information: section name: .text entropy: 7.0886542606348
Source: initial sample	Static PE information: section name: .text entropy: 7.0886542606348

Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 6.0.Scancontract103.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: C:\Users\user\Desktop\Scancontract103.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Scancontract103.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Scancontract103.exe

File opened: C:\Users\user\Desktop\Scancontract103.exe:Zone.Identifier read attributes | delete

Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Scancontract103.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 5308, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 0000000F.00000002.395467089.000000000318B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Scancontract103.exe, 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 0000000F.00000002.395467089.000000000318B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239859s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239703s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239594s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239468s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239359s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239234s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -239109s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238998s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238874s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238717s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238500s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238273s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -238138s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237999s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237856s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237736s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237594s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237475s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237359s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237232s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -237091s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236976s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236859s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236750s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236621s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236500s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236374s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236265s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -236130s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235983s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235859s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235749s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235625s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235484s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235328s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235202s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -235093s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234983s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234859s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234703s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234562s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234433s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234311s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234202s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -234076s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233937s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233797s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233670s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233545s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233422s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233296s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5176	Thread sleep time: -233156s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 5352	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 2384	Thread sleep count: 9421 > 30
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236750s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236547s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236344s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236218s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -236094s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235968s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235840s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235681s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235500s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235364s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -235203s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234995s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234820s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234697s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234588s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234453s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234328s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234156s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -234046s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233937s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233750s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233594s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233406s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233203s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -233068s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232939s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232703s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232500s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232341s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232186s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -232000s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231844s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231703s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231546s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231386s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231264s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231154s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -231039s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230906s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230776s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230639s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230531s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230373s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230229s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -230094s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229943s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229797s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229656s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229515s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229376s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -229125s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228999s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228797s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228685s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228546s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228435s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228297s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228170s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -228042s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227887s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227750s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227594s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227453s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227328s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227201s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 3660	Thread sleep time: -227047s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -240000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239703s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239500s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239250s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -239000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238844s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238686s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238546s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238344s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238203s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -238034s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237891s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237750s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237619s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237483s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237349s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237203s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -237000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236881s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236750s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236593s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236466s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -236250s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235891s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235717s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235531s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235384s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235265s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235141s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -235000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234841s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234715s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234593s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234426s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234296s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234170s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -234042s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233856s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233746s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233605s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233453s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233302s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -233141s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232995s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232844s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232733s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232594s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232453s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232327s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -232141s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231989s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231844s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231703s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231573s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231467s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231354s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231244s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -231109s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230994s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230859s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230732s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230587s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230453s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230324s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230200s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -230060s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229920s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229794s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4764	Thread sleep time: -229641s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -240000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239703s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239453s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239202s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -239088s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238889s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238656s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238500s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238356s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238250s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238140s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -238000s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237844s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237687s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237547s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237385s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237250s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -237062s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236906s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236750s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236547s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236406s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236203s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -236062s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235887s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235748s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235517s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235297s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235186s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -235059s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234936s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234797s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234652s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234500s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234368s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234230s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -234086s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233953s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233780s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233640s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233511s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233341s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -233115s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232953s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232794s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232656s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232484s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232331s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232213s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -232092s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231953s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231826s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231656s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231484s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231344s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231203s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -231073s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230844s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230656s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230406s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -230203s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229594s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229406s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229244s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -229053s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1360	Thread sleep time: -228047s >= -30000s
Source: C:\Users\user\Desktop\Scancontract103.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5056	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1096	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239468
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239359
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239234
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239109
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238998
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238874
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238717
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238273
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238138
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237999
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237856
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237736
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237475
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237359
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237232
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237091
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236976
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236621
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236374
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236265
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236130
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235983
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235749
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235625
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235484
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235202
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235093
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234983
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234562
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234433
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234311
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234202
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234076
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233670
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233545
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233422
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233296
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233156
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236547
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236344
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236218
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236094
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235968
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235840
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235681
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235364
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235203
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234995
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234820
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234697
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234588
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234453
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234156
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234046
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233406
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233203
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233068
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232939
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232341
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232186
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231844
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231546
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231386
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231264
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231154
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231039
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230906
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230776
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230639
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230531
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230373
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230229
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230094
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229943
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229656
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229515
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229376
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229125
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228999
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228685
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228546
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228435
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228297
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228170
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228042
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227887
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227453
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227201
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227047
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238686
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238546
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238344
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238034
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237891
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237619
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237483
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237349
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236881
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236466
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235891
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235717
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235531
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235384
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235265
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234841
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234715
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234426
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234296
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234170
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234042
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233856
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233746
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233605
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233302
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232995
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232733
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232594
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232327
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231989
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231573
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231467
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231354
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231244
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231109
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230994
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230859
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230732
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230587
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230324
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230200
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229920
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229794
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229641
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239202
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239088
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238889
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238356
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238140
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237687
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237547
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237385
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237062
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236906
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236547
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236062
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235887
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235748
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235517
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235297
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235186
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235059
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234936
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234797
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234652
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234368
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234230
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234086
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233780
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233640
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233511
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233341
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233115
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232794
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232484
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232331
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232213
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232092
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231826
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231484
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231344
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231073
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229594
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229244
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229053
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 228047
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 8928
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 9578
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: foregroundWindowGot 675
Source: C:\Users\user\Desktop\Scancontract103.exe	Window / User API: threadDelayed 9421
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Window / User API: threadDelayed 9541
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Window / User API: threadDelayed 9561

Source: C:\Users\user\Desktop\Scancontract103.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239468
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239359
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239234
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 239109
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238998
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238874
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238717
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238273
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 238138
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237999
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237856
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237736
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237475
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237359
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237232
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 237091
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236976
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236621
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236374
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236265
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236130
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235983
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235749
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235625
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235484
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235202
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235093
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234983
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234859
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234562
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234433
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234311
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234202
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234076
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233670
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233545
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233422
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233296
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233156
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 240000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236547
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236344
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236218
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 236094
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235968
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235840
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235681
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235364
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 235203
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234995
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234820
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234697
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234588
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234453
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234156
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 234046
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233937
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233406
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233203
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 233068
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232939
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232500
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232341
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232186
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 232000
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231844
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231703
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231546
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231386
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231264
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231154
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 231039
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230906
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230776
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230639
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230531
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230373
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230229
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 230094
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229943
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229656
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229515
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229376
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 229125
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228999
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228797
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228685
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228546
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228435
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228297
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228170
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 228042
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227887
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227750
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227594
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227453
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227328
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227201
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 227047
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238686
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238546
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238344
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238034
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237891
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237619
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237483
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237349
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236881
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236466
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235891
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235717
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235531
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235384
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235265
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234841
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234715
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234593
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234426
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234296
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234170
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234042
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233856
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233746
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233605
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233302
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232995
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232733
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232594
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232327
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232141
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231989
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231573
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231467
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231354
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231244
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231109
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230994
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230859
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230732
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230587
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230324
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230200
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230060
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229920
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229794
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229641
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 240000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239703
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239453
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239202
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 239088
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238889
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238356
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238140
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 238000
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237687
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237547
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237385
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237250
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 237062
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236906
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236750
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236547
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 236062
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235887
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235748
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235517
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235297
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235186
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 235059
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234936
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234797
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234652
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234500
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234368
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234230
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 234086
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233780
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233640
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233511
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233341
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 233115
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232794
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232484
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232331
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232213
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 232092
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231953
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231826
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231484
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231344
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 231073
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230844
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230656
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 230203
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229594
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229406
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229244
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 229053
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 228047
Source: C:\Users\user\Desktop\Scancontract103.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: dhcpmon.exe, 00000011.00000002.422414740.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\Scancontract103.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Scancontract103.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Scancontract103.exe	Memory written: C:\Users\user\Desktop\Scancontract103.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\Scancontract103.exe	Memory written: C:\Users\user\Desktop\Scancontract103.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Memory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}
Source: C:\Users\user\Desktop\Scancontract103.exe	Process created: C:\Users\user\Desktop\Scancontract103.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe {path}

Source: Scancontract103.exe, 00000006.00000002.548631838.00000000064DD000.00000004.00000010.00020000.00000000.sdmp, Scancontract103.exe, 00000006.00000002.545166472.00000000032B7000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000006.00000002.533870000.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Users\user\Desktop\Scancontract103.exe VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Scancontract103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Scancontract103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Remote Access Functionality

Detected Nanocore Rat

Source: Scancontract103.exe, 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: Scancontract103.exe, 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: dhcpmon.exe, 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: dhcpmon.exe, 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Source: Yara match	File source: 20.2.Scancontract103.exe.434b7be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5910000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.Scancontract103.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Scancontract103.exe.5914629.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.3631550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.43505f4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scancontract103.exe.37a0a00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Scancontract103.exe.4354c1d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 1760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scancontract103.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dhcpmon.exe PID: 2576, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	2 Masquerading	21 Input Capture	11 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Remote Access Software	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Hidden Files and Directories	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scancontract103.exe	40%	Virustotal		Browse
Scancontract103.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.0.Scancontract103.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File
6.2.Scancontract103.exe.5910000.4.unpack	100%	Avira	TR/NanoCore.fadte		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fonts.comc	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cna-d	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://en.wikip	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
79.134.225.6	7%	Virustotal		Browse
http://www.sakkal.com	0%	URL Reputation	safe
79.134.225.6	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cntyp9	0%	Avira URL Cloud	safe
http://www.fontbureau.commv	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
	true	Avira URL Cloud: safe	low
79.134.225.6	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	Scancontract103.exe, 00000000.00000003.272557005.00000000059C6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.comc	Scancontract103.exe, 00000000.00000003.260309270.00000000059A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cntyp9	Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cna-d	Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://en.wikip	Scancontract103.exe, 00000000.00000003.265302103.000000000598D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Scancontract103.exe, 00000000.00000003.263528849.0000000005986000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263806579.000000000598E000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000003.263335099.0000000005985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comoitu	Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	Scancontract103.exe, 00000000.00000003.266935495.0000000005989000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commv	Scancontract103.exe, 00000000.00000003.301534585.0000000005980000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Scancontract103.exe, 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Scancontract103.exe, 00000000.00000003.266747836.00000000059C6000.00000004.00000800.00020000.00000000.sdmp, Scancontract103.exe, 00000000.00000002.318121730.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/	Scancontract103.exe, 00000000.00000003.269009492.00000000059C5000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.134.225.6	unknown	Switzerland		6775	FINK-TELECOM-SERVICESCH	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	713039
Start date and time:	2022-09-29 22:57:49 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Scancontract103.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@26/8@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:58:48	API Interceptor	969x Sleep call for process: Scancontract103.exe modified
22:59:13	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
22:59:16	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\Desktop\Scancontract103.exe" s>$(Arg0)
22:59:16	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
22:59:26	API Interceptor	255x Sleep call for process: dhcpmon.exe modified

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	854528
Entropy (8bit):	7.084655686253337
Encrypted:	false
SSDEEP:	12288:sx9I2iNl/joW7EsJ2uM1DgC9tqGdpb5QyXYzvtMdADqjJ5ns:N1fEW7T4RDgvGdpHYzQjrs
MD5:	9D2A2B596CD979FC9674824D2AA731DF
SHA1:	015E8AE0F838E0FBA35643297530A5B9A66E4186
SHA-256:	C4A2C953833C8D6B5D2EF71B997700559ECC9F23573D89072D205F963E46956C
SHA-512:	768843F52697AC5A8E8FF71FF5A66BCA977CC6FAD9DA349CE77EEE431AA5252EC07187D52BCE92BD50BBCEC1A10B6CE1A9123DBAFA1E34D7A36AC2A9E511CEF3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5c..............P.................. ... ....@.. .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........Z...W......;...\|....a............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r/..p~....o-...(......t$....+..*...0..&........(....rA..p~....o-...(......

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84bE4KnKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxvbHKnYHKhQnoPtHoxH5
MD5:	A7D610296B11732FD61A88BC218783AC
SHA1:	EE89E72AF3A15DAB847055A9F9F88FD934113857
SHA-256:	7F3A7CE69B42D8C832F0FBB57C0523D6F098DC090D39616C05277F8DB9F4F9E9
SHA-512:	8C0AC1893FF0A7FE287D4FC650943D33D1546200A89C2A502FE9BCB11DA6227533FD8F966EE8651B7E7BD8B5EA11403AD930D022D1D75B3EAA6D24D625F779DF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

Download File

Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84bE4KnKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxvbHKnYHKhQnoPtHoxH5
MD5:	A7D610296B11732FD61A88BC218783AC
SHA1:	EE89E72AF3A15DAB847055A9F9F88FD934113857
SHA-256:	7F3A7CE69B42D8C832F0FBB57C0523D6F098DC090D39616C05277F8DB9F4F9E9
SHA-512:	8C0AC1893FF0A7FE287D4FC650943D33D1546200A89C2A502FE9BCB11DA6227533FD8F966EE8651B7E7BD8B5EA11403AD930D022D1D75B3EAA6D24D625F779DF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configu

C:\Users\user\AppData\Local\Temp\tmp1090.tmp

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	5.103232147891814
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0hxtn:cbk4oL600QydbQxIYODOLedq3Ij
MD5:	965D081052473031B1DA64E2A9CA6356
SHA1:	2CE6D29C2C4C5E0AAF98B74E3661A7C8A214B554
SHA-256:	81A542AC638DC1591CE04076330AAC190AA871FCD83AD2F3AB3C758BF6BB7713
SHA-512:	27338E725AB8992E95A77425347AED5878829AAEBBBFF14348E610DB2F8255F812CDAA636E11B1128C1637C982C4B8E58E670FD8D4F97E6694C8A4EDE849A8B4
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:YRH/t:Yhl
MD5:	3D6AAF34F494EBB7AEE72D9F1E409974
SHA1:	AB6D9E593DF00E22315A1ED553CAFA40EFEE1FBA
SHA-256:	D1B3C5C1EB2839519CA0B0E4E5DCF6120D0A14E2D81056AC11F2057443740705
SHA-512:	14B3475E8E166D8351CC349F62EF6B1572793E07A6ADA611C2B4412A17951D4A3D08BC757F4D8542AB98E6A9024F4873F7417B7996B6B710BA2A8A54BF6087B5
Malicious:	true
Preview:	.l...H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Download File

Process:	C:\Users\user\Desktop\Scancontract103.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.350068910616443
Encrypted:	false
SSDEEP:	3:oNWXp5v2GOUDu:oNWXpF2/
MD5:	AA619EA44F715A3F4CF627DD80CFED11
SHA1:	5BFC5B8E726014C10FD0226AFAE783DEC203CB6B
SHA-256:	25186E981F6DA5CA846C5BC3A97592D4D39BA2F43AB7AA2A0B4088C5FA54AAB4
SHA-512:	2255746B212D29944BDA7AFD8294D5A3E073908670BFDA9038FB68C056302F4F01B757AC22F95A72076443690B6228B73A9A94CB5383E2CE510ED98910B43DA3
Malicious:	false
Preview:	C:\Users\user\Desktop\Scancontract103.exe

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.084655686253337
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Scancontract103.exe
File size:	854528
MD5:	9d2a2b596cd979fc9674824d2aa731df
SHA1:	015e8ae0f838e0fba35643297530a5b9a66e4186
SHA256:	c4a2c953833c8d6b5d2ef71b997700559ecc9f23573d89072d205f963e46956c
SHA512:	768843f52697ac5a8e8ff71ff5a66bca977cc6fad9da349ce77eee431aa5252ec07187d52bce92bd50bbcec1a10b6ce1a9123dbafa1e34d7a36ac2a9e511cef3
SSDEEP:	12288:sx9I2iNl/joW7EsJ2uM1DgC9tqGdpb5QyXYzvtMdADqjJ5ns:N1fEW7T4RDgvGdpHYzQjrs
TLSH:	11054A2429EB922CF4B69BF95FC8F8FB4C5BFA61252960F624A153468B33E05CCD1435
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....5c..............P.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d13d6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63358100 [Thu Sep 29 11:26:56 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd1384	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x11ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcf3dc	0xcf400	False	0.697853447300965	COM executable for DOS	7.0886542606348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd2000	0x11ec	0x1200	False	0.3947482638888889	data	5.057459517659846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd2090	0x330	data
RT_MANIFEST	0xd23d0	0xe15	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2022 22:59:20.027470112 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:20.040286064 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:20.590548992 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:20.603280067 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:21.293834925 CEST	49707	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:21.306813955 CEST	60110	49707	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:26.231312990 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:26.244163036 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:26.762944937 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:26.775790930 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:27.372375965 CEST	49708	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:27.385637999 CEST	60110	49708	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:31.717842102 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:31.732376099 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:32.294923067 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:32.307845116 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:32.888734102 CEST	49709	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:32.901580095 CEST	60110	49709	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:37.211786985 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:37.224678040 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:37.763921022 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:37.776861906 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:38.373284101 CEST	49710	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:38.386439085 CEST	60110	49710	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:43.012607098 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:43.025531054 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:43.592551947 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:43.605590105 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:44.295752048 CEST	49711	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:44.308585882 CEST	60110	49711	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:48.728755951 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:48.741656065 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:49.296158075 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:49.309087992 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:49.983714104 CEST	49712	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:49.996527910 CEST	60110	49712	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:54.070527077 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:54.083321095 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:54.765382051 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:54.778515100 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:55.374838114 CEST	49713	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:55.387594938 CEST	60110	49713	79.134.225.6	192.168.2.3
Sep 29, 2022 22:59:59.943087101 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 22:59:59.956547022 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:00.484608889 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:00.499109030 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:01.094042063 CEST	49714	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:01.107193947 CEST	60110	49714	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:05.524106979 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:05.537091970 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:06.082381010 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:06.095248938 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:06.766412020 CEST	49715	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:06.779191971 CEST	60110	49715	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:10.834242105 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:10.847059965 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:11.464692116 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:11.477426052 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:11.985686064 CEST	49716	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:11.998442888 CEST	60110	49716	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:16.608930111 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:16.621793032 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:17.267476082 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:17.280277967 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:17.876717091 CEST	49717	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:17.890031099 CEST	60110	49717	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:21.904520988 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:21.918123960 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:22.486566067 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:22.499701023 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:23.174092054 CEST	49718	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:23.187195063 CEST	60110	49718	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:27.675836086 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:27.688648939 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:28.205789089 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:28.218532085 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:28.721540928 CEST	49719	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:28.734438896 CEST	60110	49719	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:32.754986048 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:32.768208027 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:33.268742085 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:33.281815052 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:33.784370899 CEST	49720	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:33.797348976 CEST	60110	49720	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:37.803364038 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:37.816562891 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:38.316065073 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:38.329046965 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:38.831706047 CEST	49721	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:38.844505072 CEST	60110	49721	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:42.998397112 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:43.011187077 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:43.597734928 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:43.610474110 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:44.207194090 CEST	49722	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:44.220000029 CEST	60110	49722	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:48.225795031 CEST	49723	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:48.238611937 CEST	60110	49723	79.134.225.6	192.168.2.3
Sep 29, 2022 23:00:48.754570961 CEST	49723	60110	192.168.2.3	79.134.225.6
Sep 29, 2022 23:00:48.767365932 CEST	60110	49723	79.134.225.6	192.168.2.3

Target ID:	0
Start time:	22:58:46
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scancontract103.exe"
Imagebase:	0x170000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.308527260.0000000003571000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.303876077.00000000025BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.311167352.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: Scancontract103.exePID: 1760, Parent PID: 3732

General

Target ID:	6
Start time:	22:59:07
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x970000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.547986042.0000000005900000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000000.299936604.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.530169744.0000000002E21000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.548040807.0000000005910000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: schtasks.exePID: 2636, Parent PID: 1760

General

Target ID:	11
Start time:	22:59:14
Start date:	29/09/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpCA7.tmp
Imagebase:	0x7ff745070000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 4744, Parent PID: 2636

General

Target ID:	12
Start time:	22:59:14
Start date:	29/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: schtasks.exePID: 2300, Parent PID: 1760

General

Target ID:	13
Start time:	22:59:15
Start date:	29/09/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmp1090.tmp
Imagebase:	0x1160000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 5056, Parent PID: 2300

General

Target ID:	14
Start time:	22:59:15
Start date:	29/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: Scancontract103.exePID: 6052, Parent PID: 1080

General

Target ID:	15
Start time:	22:59:16
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Scancontract103.exe 0
Imagebase:	0xd50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: dhcpmon.exePID: 5308, Parent PID: 1080

General

Target ID:	16
Start time:	22:59:16
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
Imagebase:	0xe90000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000010.00000002.400735152.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: dhcpmon.exePID: 1012, Parent PID: 3452

General

Target ID:	17
Start time:	22:59:22
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
Imagebase:	0xa70000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Analysis Process: Scancontract103.exePID: 3988, Parent PID: 6052

General

Target ID:	18
Start time:	22:59:45
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x2a0000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: dhcpmon.exePID: 4632, Parent PID: 5308

General

Target ID:	19
Start time:	22:59:45
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x390000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: Scancontract103.exePID: 5588, Parent PID: 6052

General

Target ID:	20
Start time:	22:59:46
Start date:	29/09/2022
Path:	C:\Users\user\Desktop\Scancontract103.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xd50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000014.00000002.442532353.0000000004309000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000014.00000002.440811827.0000000003301000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: dhcpmon.exePID: 2576, Parent PID: 5308

General

Target ID:	21
Start time:	22:59:46
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x990000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000015.00000002.443127439.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: dhcpmon.exePID: 2300, Parent PID: 1012

General

Target ID:	22
Start time:	22:59:53
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x180000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: dhcpmon.exePID: 5420, Parent PID: 1012

General

Target ID:	23
Start time:	22:59:55
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x50000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: dhcpmon.exePID: 408, Parent PID: 1012

General

Target ID:	24
Start time:	22:59:55
Start date:	29/09/2022
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x870000
File size:	854528 bytes
MD5 hash:	9D2A2B596CD979FC9674824D2AA731DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scancontract103.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scancontract103.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

C:\Users\user\AppData\Local\Temp\tmp1090.tmp

C:\Users\user\AppData\Local\Temp\tmpCA7.tmp

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

Static File Info

Windows Analysis Report
Scancontract103.exe