Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
8249boAXzf.exe

Overview

General Information

Sample Name:8249boAXzf.exe
Analysis ID:798193
MD5:b6c9e205bbe4752d743e4f49588bf35c
SHA1:dca5d1249746a9c95e78ad6f1c71b9598081b895
SHA256:3b9b213448c7d1d3b5b9f9c19cdad35e6215af54e1e2e4995a74877f02bf8e0a
Tags:exeNanoCoreRAT
Infos:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Yara detected AntiVM3
Detected Nanocore Rat
Sigma detected: Scheduled temp file as task from temp location
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses dynamic DNS services
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • 8249boAXzf.exe (PID: 1604 cmdline: C:\Users\user\Desktop\8249boAXzf.exe MD5: B6C9E205BBE4752D743E4F49588BF35C)
    • 8249boAXzf.exe (PID: 1308 cmdline: C:\Users\user\Desktop\8249boAXzf.exe MD5: B6C9E205BBE4752D743E4F49588BF35C)
      • schtasks.exe (PID: 5768 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • schtasks.exe (PID: 2224 cmdline: schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpE922.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)
        • conhost.exe (PID: 5920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • 8249boAXzf.exe (PID: 5312 cmdline: C:\Users\user\Desktop\8249boAXzf.exe 0 MD5: B6C9E205BBE4752D743E4F49588BF35C)
    • 8249boAXzf.exe (PID: 808 cmdline: C:\Users\user\Desktop\8249boAXzf.exe MD5: B6C9E205BBE4752D743E4F49588BF35C)
  • dhcpmon.exe (PID: 5932 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0 MD5: B6C9E205BBE4752D743E4F49588BF35C)
    • dhcpmon.exe (PID: 632 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: B6C9E205BBE4752D743E4F49588BF35C)
  • dhcpmon.exe (PID: 3320 cmdline: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" MD5: B6C9E205BBE4752D743E4F49588BF35C)
    • dhcpmon.exe (PID: 6052 cmdline: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe MD5: B6C9E205BBE4752D743E4F49588BF35C)
  • cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "be28fce4-4930-4ffe-96ed-0110cf99", "Group": "SecureKMT", "Domain1": "tzitziklishop.ddns.net", "Domain2": "127.0.0.1", "Port": 1665, "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth (Nextron Systems)
  • 0xf7ad:$x1: NanoCore.ClientPluginHost
  • 0xf7da:$x2: IClientNetworkHost
00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth (Nextron Systems)
  • 0xf7ad:$x2: NanoCore.ClientPluginHost
  • 0x10888:$s4: PipeCreated
  • 0xf7c7:$s5: IClientLoggingHost
00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_NanocoreYara detected Nanocore RATJoe Security
    00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpMALWARE_Win_NanoCoreDetects NanoCoreditekSHen
    • 0xf778:$x2: NanoCore.ClientPlugin
    • 0xf7ad:$x3: NanoCore.ClientPluginHost
    • 0xf76c:$i2: IClientData
    • 0xf78e:$i3: IClientNetwork
    • 0xf79d:$i5: IClientDataHost
    • 0xf7c7:$i6: IClientLoggingHost
    • 0xf7da:$i7: IClientNetworkHost
    • 0xf7ed:$i8: IClientUIHost
    • 0xf7fb:$i9: IClientNameObjectCollection
    • 0xf817:$i10: IClientReadOnlyNameObjectCollection
    • 0xf56a:$s1: ClientPlugin
    • 0xf781:$s1: ClientPlugin
    • 0x147a2:$s6: get_ClientSettings
    00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
    • 0xf7ad:$a1: NanoCore.ClientPluginHost
    • 0xf778:$a2: NanoCore.ClientPlugin
    • 0x146f3:$b1: get_BuilderSettings
    • 0x14662:$b7: LogClientException
    • 0xf7c7:$b9: IClientLoggingHost
    Click to see the 103 entries

    Unpacked PEs

    SourceRuleDescriptionAuthorStrings
    1.2.8249boAXzf.exe.7070000.26.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth (Nextron Systems)
    • 0x605:$x1: NanoCore.ClientPluginHost
    • 0x63e:$x2: IClientNetworkHost
    1.2.8249boAXzf.exe.7070000.26.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth (Nextron Systems)
    • 0x605:$x2: NanoCore.ClientPluginHost
    • 0x720:$s4: PipeCreated
    • 0x61f:$s5: IClientLoggingHost
    1.2.8249boAXzf.exe.7070000.26.unpackMALWARE_Win_NanoCoreDetects NanoCoreditekSHen
    • 0x67f:$x2: NanoCore.ClientPlugin
    • 0x605:$x3: NanoCore.ClientPluginHost
    • 0x695:$i3: IClientNetwork
    • 0x61f:$i6: IClientLoggingHost
    • 0x63e:$i7: IClientNetworkHost
    • 0x688:$s1: ClientPlugin
    1.2.8249boAXzf.exe.7070000.26.unpackWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
    • 0x605:$a1: NanoCore.ClientPluginHost
    • 0x67f:$a2: NanoCore.ClientPlugin
    • 0xda0:$b7: LogClientException
    • 0x61f:$b9: IClientLoggingHost
    1.2.8249boAXzf.exe.5200000.18.raw.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth (Nextron Systems)
    • 0xe75:$x1: NanoCore.ClientPluginHost
    • 0xe8f:$x2: IClientNetworkHost
    Click to see the 287 entries

    Sigma Signatures

    AV Detection

    barindex
    Sigma detected: NanoCore
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\8249boAXzf.exe, ProcessId: 1308, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

    E-Banking Fraud

    barindex
    Sigma detected: NanoCore
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\8249boAXzf.exe, ProcessId: 1308, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

    Persistence and Installation Behavior

    barindex
    Sigma detected: Scheduled temp file as task from temp location
    Source: Process startedAuthor: Joe Security: Data: Command: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp, CommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\8249boAXzf.exe, ParentImage: C:\Users\user\Desktop\8249boAXzf.exe, ParentProcessId: 1308, ParentProcessName: 8249boAXzf.exe, ProcessCommandLine: schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp, ProcessId: 5768, ProcessName: schtasks.exe

    Stealing of Sensitive Information

    barindex
    Sigma detected: NanoCore
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\8249boAXzf.exe, ProcessId: 1308, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

    Remote Access Functionality

    barindex
    Sigma detected: NanoCore
    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\8249boAXzf.exe, ProcessId: 1308, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

    Snort Signatures

    Timestamp:192.168.2.445.12.253.264969716652816766 02/03/23-20:51:34.809216
    SID:2816766
    Source Port:49697
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969916652816718 02/03/23-20:52:00.320309
    SID:2816718
    Source Port:49699
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969916652025019 02/03/23-20:51:59.365399
    SID:2025019
    Source Port:49699
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969616652025019 02/03/23-20:51:19.153314
    SID:2025019
    Source Port:49696
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970716652025019 02/03/23-20:52:53.744703
    SID:2025019
    Source Port:49707
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970316652025019 02/03/23-20:52:24.202333
    SID:2025019
    Source Port:49703
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969816652025019 02/03/23-20:51:52.381168
    SID:2025019
    Source Port:49698
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969616652816766 02/03/23-20:51:21.438493
    SID:2816766
    Source Port:49696
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:45.12.253.26192.168.2.41665497082841753 02/03/23-20:53:00.690723
    SID:2841753
    Source Port:1665
    Destination Port:49708
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970516652816766 02/03/23-20:52:38.060859
    SID:2816766
    Source Port:49705
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970616652025019 02/03/23-20:52:43.731524
    SID:2025019
    Source Port:49706
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970216652025019 02/03/23-20:52:17.969073
    SID:2025019
    Source Port:49702
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:45.12.253.26192.168.2.41665496972841753 02/03/23-20:51:33.287370
    SID:2841753
    Source Port:1665
    Destination Port:49697
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:45.12.253.26192.168.2.41665497012841753 02/03/23-20:52:13.290690
    SID:2841753
    Source Port:1665
    Destination Port:49701
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969716652025019 02/03/23-20:51:28.080721
    SID:2025019
    Source Port:49697
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970816652025019 02/03/23-20:53:00.640434
    SID:2025019
    Source Port:49708
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:45.12.253.26192.168.2.41665497042841753 02/03/23-20:52:31.335061
    SID:2841753
    Source Port:1665
    Destination Port:49704
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969916652816766 02/03/23-20:52:00.320309
    SID:2816766
    Source Port:49699
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970516652025019 02/03/23-20:52:36.965086
    SID:2025019
    Source Port:49705
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970016652816766 02/03/23-20:52:07.473582
    SID:2816766
    Source Port:49700
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970616652816766 02/03/23-20:52:45.300274
    SID:2816766
    Source Port:49706
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970116652025019 02/03/23-20:52:13.244304
    SID:2025019
    Source Port:49701
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970416652025019 02/03/23-20:52:31.301944
    SID:2025019
    Source Port:49704
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264969816652816766 02/03/23-20:51:54.258053
    SID:2816766
    Source Port:49698
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:45.12.253.26192.168.2.41665496982810290 02/03/23-20:51:53.335571
    SID:2810290
    Source Port:1665
    Destination Port:49698
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970716652816766 02/03/23-20:52:55.548418
    SID:2816766
    Source Port:49707
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970016652025019 02/03/23-20:52:05.685748
    SID:2025019
    Source Port:49700
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.445.12.253.264970316652816766 02/03/23-20:52:25.242824
    SID:2816766
    Source Port:49703
    Destination Port:1665
    Protocol:TCP
    Classtype:A Network Trojan was detected

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: 8249boAXzf.exeReversingLabs: Detection: 31%
    Source: 8249boAXzf.exeVirustotal: Detection: 37%Perma Link
    Antivirus detection for URL or domain
    Source: tzitziklishop.ddns.netAvira URL Cloud: Label: malware
    Multi AV Scanner detection for domain / URL
    Source: tzitziklishop.ddns.netVirustotal: Detection: 12%Perma Link
    Source: tzitziklishop.ddns.netVirustotal: Detection: 12%Perma Link
    Multi AV Scanner detection for dropped file
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeReversingLabs: Detection: 31%
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeVirustotal: Detection: 37%Perma Link
    Yara detected Nanocore RAT
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTR
    Machine Learning detection for sample
    Source: 8249boAXzf.exeJoe Sandbox ML: detected
    Machine Learning detection for dropped file
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJoe Sandbox ML: detected
    Source: 9.2.8249boAXzf.exe.400000.0.unpackAvira: Label: TR/Dropper.MSIL.Gen7
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpackAvira: Label: TR/NanoCore.fadte
    Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "be28fce4-4930-4ffe-96ed-0110cf99", "Group": "SecureKMT", "Domain1": "tzitziklishop.ddns.net", "Domain2": "127.0.0.1", "Port": 1665, "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}
    Source: 8249boAXzf.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: 8249boAXzf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
    Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp
    Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: 8249boAXzf.exe, 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp

    Networking

    barindex
    Snort IDS alert for network traffic
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49696 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49696 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49697 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49697 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 45.12.253.26:1665 -> 192.168.2.4:49697
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49698 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49698 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 45.12.253.26:1665 -> 192.168.2.4:49698
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49699 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49699 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.2.4:49699 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49700 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49700 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49701 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 45.12.253.26:1665 -> 192.168.2.4:49701
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49702 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49703 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49703 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49704 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 45.12.253.26:1665 -> 192.168.2.4:49704
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49705 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49705 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49706 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49706 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49707 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.2.4:49707 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49708 -> 45.12.253.26:1665
    Source: TrafficSnort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 45.12.253.26:1665 -> 192.168.2.4:49708
    C2 URLs / IPs found in malware configuration
    Source: Malware configuration extractorURLs: tzitziklishop.ddns.net
    Source: Malware configuration extractorURLs: 127.0.0.1
    Uses dynamic DNS services
    Source: unknownDNS query: name: tzitziklishop.ddns.net
    Source: Joe Sandbox ViewASN Name: CMCSUS CMCSUS
    Source: Joe Sandbox ViewIP Address: 45.12.253.26 45.12.253.26
    Source: global trafficTCP traffic: 192.168.2.4:49696 -> 45.12.253.26:1665
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://google.com
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
    Source: 8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
    Source: unknownDNS traffic detected: queries for: tzitziklishop.ddns.net
    Source: 8249boAXzf.exe, 00000000.00000002.336548178.0000000000BE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
    Source: 8249boAXzf.exe, 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: RegisterRawInputDevices

    E-Banking Fraud

    barindex
    Yara detected Nanocore RAT
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTR

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 7.2.dhcpmon.exe.26ea7e4.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0.2.8249boAXzf.exe.2ada79c.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000003.363835446.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 0000000A.00000002.438174949.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: Detetcs the Nanocore RAT Author: Florian Roth (Nextron Systems)
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
    Source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
    Source: 8249boAXzf.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7070000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5200000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70e0000.33.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.44eb795.17.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46e99de.14.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70b0000.30.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 10.2.dhcpmon.exe.3f095d0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70b0000.30.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7060000.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5d20000.19.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.46d277f.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7120000.35.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7090000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70e0000.33.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5d70000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 7.2.dhcpmon.exe.26ea7e4.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70d0000.31.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5d20000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70a0000.29.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.2be597c.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2be597c.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7080000.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2b8cc38.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46d277f.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7060000.25.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70a0000.29.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7090000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70ee8a4.34.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.64f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0.2.8249boAXzf.exe.2ada79c.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 9.2.8249boAXzf.exe.2a1956c.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 10.2.dhcpmon.exe.2f09684.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2bf1bc4.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.44df561.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46e99de.14.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5d70000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70e4c9f.32.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7120000.35.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.70d0000.31.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46db5ae.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.2c06200.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.7070000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.46db5ae.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000003.363835446.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 0000000A.00000002.438174949.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth (Nextron Systems), description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
    Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth (Nextron Systems), description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
    Source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_00BAC1F40_2_00BAC1F4
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_00BAE6380_2_00BAE638
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_00BAE6280_2_00BAE628
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_085D30F00_2_085D30F0
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_085D30E10_2_085D30E1
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_085D33900_2_085D3390
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_085D33810_2_085D3381
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_088000110_2_08800011
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 0_2_088000400_2_08800040
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_010CE4711_2_010CE471
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_010CE4801_2_010CE480
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_010CBBD41_2_010CBBD4
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_02B0F5F81_2_02B0F5F8
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_02B0A5F81_2_02B0A5F8
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_02B0A5D01_2_02B0A5D0
    Source: 8249boAXzf.exe, 00000000.00000000.313009127.00000000005AA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamevdVZ.exe8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000000.00000002.342245474.0000000003AEB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000000.00000002.336548178.0000000000BE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000000.00000002.371696050.0000000007230000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613406938.0000000007108000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPluginNew.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613896406.000000000712E000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.609230267.0000000006140000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPluginNew.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000003.363835446.0000000000EBE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAForge.Video.DirectShow.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNAudio.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameToolsClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.579731239.0000000000DEA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameManagementClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreBase.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameFileBrowserClient.dllT vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPlugin.dll@ vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNanoCoreStressTester.dll< vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNetworkClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCoreClientPlugin.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMyClientPluginNew.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000001.00000002.613288748.00000000070D8000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSecurityClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000006.00000002.401436591.0000000003F3A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000006.00000002.401436591.0000000003FA8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.0000000003A31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameClientPlugin.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.0000000003A20000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLzma#.dll4 vs 8249boAXzf.exe
    Source: 8249boAXzf.exeBinary or memory string: OriginalFilenamevdVZ.exe8 vs 8249boAXzf.exe
    Source: 8249boAXzf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: dhcpmon.exe.1.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: 8249boAXzf.exeReversingLabs: Detection: 31%
    Source: 8249boAXzf.exeVirustotal: Detection: 37%
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile read: C:\Users\user\Desktop\8249boAXzf.exeJump to behavior
    Source: 8249boAXzf.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\8249boAXzf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exe
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exe
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp
    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpE922.tmp
    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exe 0
    Source: unknownProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
    Source: unknownProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exe
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exeJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmpJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpE922.tmpJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exeJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8249boAXzf.exe.logJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile created: C:\Users\user\AppData\Local\Temp\tmpE75C.tmpJump to behavior
    Source: classification engineClassification label: mal100.troj.evad.winEXE@18/11@13/1
    Source: 8249boAXzf.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
    Source: C:\Users\user\Desktop\8249boAXzf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
    Source: C:\Users\user\Desktop\8249boAXzf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{be28fce4-4930-4ffe-96ed-0110cf99b889}
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:120:WilError_01
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:120:WilError_01
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile created: C:\Program Files (x86)\DHCP MonitorJump to behavior
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'CreateDecryptor'
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.csCryptographic APIs: 'TransformFinalBlock'
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
    Source: 8249boAXzf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
    Source: 8249boAXzf.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
    Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp
    Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: 8249boAXzf.exe, 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp

    Data Obfuscation

    barindex
    .NET source code contains potential unpacker
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
    Source: C:\Users\user\Desktop\8249boAXzf.exeCode function: 1_2_02B069F8 pushad ; retf 1_2_02B069F9
    Source: initial sampleStatic PE information: section name: .text entropy: 7.645229548325504
    Source: initial sampleStatic PE information: section name: .text entropy: 7.645229548325504
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.csHigh entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
    Source: 9.2.8249boAXzf.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.csHigh entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJump to dropped file

    Boot Survival

    barindex
    Uses schtasks.exe or at.exe to add and modify task schedules
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp

    Hooking and other Techniques for Hiding and Protection

    barindex
    Hides that the sample has been downloaded from the Internet (zone.identifier)
    Source: C:\Users\user\Desktop\8249boAXzf.exeFile opened: C:\Users\user\Desktop\8249boAXzf.exe:Zone.Identifier read attributes | deleteJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Yara detected AntiVM3
    Source: Yara matchFile source: 7.2.dhcpmon.exe.26ea7e4.2.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.2ada79c.1.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.337798230.0000000002AB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: dhcpmon.exe PID: 5932, type: MEMORYSTR
    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
    Source: 8249boAXzf.exe, 00000000.00000002.337798230.0000000002AB7000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000006.00000002.398479843.0000000002D55000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000008.00000002.412985197.0000000002B95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
    Source: 8249boAXzf.exe, 00000000.00000002.337798230.0000000002AB7000.00000004.00000800.00020000.00000000.sdmp, dhcpmon.exe, 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 2708Thread sleep time: -37665s >= -30000sJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 6136Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 6040Thread sleep time: -16602069666338586s >= -30000sJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 3112Thread sleep time: -37665s >= -30000sJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 5928Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5964Thread sleep time: -37665s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1804Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4992Thread sleep time: -37665s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 3508Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exe TID: 5468Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5752Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5988Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477
    Source: C:\Users\user\Desktop\8249boAXzf.exeWindow / User API: threadDelayed 9660Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeWindow / User API: foregroundWindowGot 532Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeWindow / User API: foregroundWindowGot 596Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 37665Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 37665Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 37665Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 37665Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeThread delayed: delay time: 922337203685477
    Source: dhcpmon.exe, 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
    Source: dhcpmon.exe, 00000008.00000002.412985197.0000000002B95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
    Source: dhcpmon.exe, 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
    Source: 8249boAXzf.exe, 00000001.00000003.377582623.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.579731239.0000000000E89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: dhcpmon.exe, 00000008.00000002.412985197.0000000002B95000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeMemory allocated: page read and write | page guardJump to behavior

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Injects a PE file into a foreign processes
    Source: C:\Users\user\Desktop\8249boAXzf.exeMemory written: C:\Users\user\Desktop\8249boAXzf.exe base: 400000 value starts with: 4D5AJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeMemory written: C:\Users\user\Desktop\8249boAXzf.exe base: 400000 value starts with: 4D5AJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeMemory written: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe base: 400000 value starts with: 4D5AJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exeJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmpJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpE922.tmpJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeProcess created: C:\Users\user\Desktop\8249boAXzf.exe C:\Users\user\Desktop\8249boAXzf.exeJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeProcess created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeJump to behavior
    Source: 8249boAXzf.exe, 00000001.00000002.616461744.00000000081FC000.00000004.00000010.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002FFF000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
    Source: 8249boAXzf.exe, 00000001.00000002.610290578.000000000664E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Manager$
    Source: 8249boAXzf.exe, 00000001.00000002.614896365.00000000079FC000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program ManagerD
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerD$
    Source: 8249boAXzf.exe, 00000001.00000002.618041706.0000000009B5E000.00000004.00000010.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.616395718.00000000080FB000.00000004.00000010.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.618427219.000000000A05F000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Managerram Manager
    Source: 8249boAXzf.exe, 00000001.00000002.617983642.000000000995F000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Manager`I0s
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002CCC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managerx
    Source: 8249boAXzf.exe, 00000001.00000002.608610587.0000000005EDB000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Manager`I0s
    Source: 8249boAXzf.exe, 00000001.00000002.618335356.0000000009F1E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Managerram ManagerD
    Source: 8249boAXzf.exe, 00000001.00000002.609892964.00000000064CA000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Managerram Manager$
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000003179000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager4
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerXQ
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002EE6000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.583394625.0000000002E2A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerHa
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Users\user\Desktop\8249boAXzf.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Users\user\Desktop\8249boAXzf.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Users\user\Desktop\8249boAXzf.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Users\user\Desktop\8249boAXzf.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
    Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
    Source: C:\Users\user\Desktop\8249boAXzf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
    Source: C:\Users\user\Desktop\8249boAXzf.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

    Stealing of Sensitive Information

    barindex
    Yara detected Nanocore RAT
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTR

    Remote Access Functionality

    barindex
    Detected Nanocore Rat
    Source: 8249boAXzf.exe, 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000003.363835446.0000000000EBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: 8249boAXzf.exe, 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
    Source: 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
    Source: 8249boAXzf.exe, 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: 8249boAXzf.exe, 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: 8249boAXzf.exe, 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: dhcpmon.exe, 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: dhcpmon.exe, 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
    Source: dhcpmon.exe, 0000000A.00000002.438174949.0000000003F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
    Source: dhcpmon.exe, 0000000A.00000002.438174949.0000000003F18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: HApplicationBaseMicrosoft.VisualBasic.ApplicationServicesUserConversionsMicrosoft.VisualBasic.CompilerServicesObjectFlowControlOperatorsProjectDataStandardModuleAttributeComputerMicrosoft.VisualBasic.DevicesHideModuleNameAttributeMyGroupCollectionAttributeContextValue`1Microsoft.VisualBasic.MyServices.InternalClientInvokeDelegateNanoCoreIClientDataNanoCore.ClientPluginIClientNetworkIClientDataHostNanoCore.ClientPluginHostIClientLoggingHostIClientNetworkHostIClientUIHostIClientNameObjectCollectionIClientReadOnlyNameObjectCollectionActivatorAppDomainArgumentOutOfRangeExceptionArrayAsyncCallbackBitConverterBooleanBufferByteCharCLSCompliantAttributeGeneratedCodeAttributeSystem.CodeDom.CompilerDictionary`2System.Collections.GenericEnumeratorIEnumerable`1KeyValuePair`2List`1IEnumeratorSystem.CollectionsEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateApplicationSettingsBaseSystem.ConfigurationSettingsBaseDateTimeDateTimeKindDelegateDebuggerDisplayAttributeSystem.DiagnosticsDebugge
    Yara detected Nanocore RAT
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3d88b78.9.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a04c1d.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.400000.0.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.460a331.4.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.3a005f4.6.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 9.2.8249boAXzf.exe.39fb7be.3.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4605d08.12.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.47668a8.6.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd0000.21.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44eb795.17.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.5fd4629.22.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4600ed2.11.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 0.2.8249boAXzf.exe.3dbb798.12.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.4761a72.13.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.476aed1.5.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44ffdc2.15.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 1.2.8249boAXzf.exe.44df561.8.raw.unpack, type: UNPACKEDPE
    Source: Yara matchFile source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1604, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 1308, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: 8249boAXzf.exe PID: 808, type: MEMORYSTR
    Source: Yara matchFile source: Process Memory Space: dhcpmon.exe PID: 632, type: MEMORYSTR

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts1
    Windows Management Instrumentation    		1
    Scheduled Task/Job    		112
    Process Injection    		2
    Masquerading    		21
    Input Capture    		211
    Security Software Discovery    		Remote Services21
    Input Capture    		Exfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default Accounts1
    Scheduled Task/Job    		Boot or Logon Initialization Scripts1
    Scheduled Task/Job    		1
    Disable or Modify Tools    		LSASS Memory2
    Process Discovery    		Remote Desktop Protocol11
    Archive Collected Data    		Exfiltration Over Bluetooth1
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)21
    Virtualization/Sandbox Evasion    		Security Account Manager21
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Remote Access Software    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)112
    Process Injection    		NTDS1
    Application Window Discovery    		Distributed Component Object ModelInput CaptureScheduled Transfer1
    Non-Application Layer Protocol    		SIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
    Deobfuscate/Decode Files or Information    		LSA Secrets12
    System Information Discovery    		SSHKeyloggingData Transfer Size Limits21
    Application Layer Protocol    		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.common1
    Hidden Files and Directories    		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup Items2
    Obfuscated Files or Information    		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job13
    Software Packing    		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 798193 Sample: 8249boAXzf.exe Startdate: 03/02/2023 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Multi AV Scanner detection for domain / URL 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 14 other signatures 2->55 8 8249boAXzf.exe 3 2->8         started        12 dhcpmon.exe 2 2->12         started        14 8249boAXzf.exe 2 2->14         started        16 dhcpmon.exe 3 2->16         started        process3 file4 45 C:\Users\user\AppData\...\8249boAXzf.exe.log, ASCII 8->45 dropped 59 Uses schtasks.exe or at.exe to add and modify task schedules 8->59 61 Injects a PE file into a foreign processes 8->61 18 8249boAXzf.exe 1 15 8->18         started        23 dhcpmon.exe 12->23         started        25 8249boAXzf.exe 2 14->25         started        27 dhcpmon.exe 16->27         started        signatures5 process6 dnsIp7 47 tzitziklishop.ddns.net 45.12.253.26, 1665, 49696, 49697 CMCSUS Germany 18->47 37 C:\Program Files (x86)\...\dhcpmon.exe, PE32 18->37 dropped 39 C:\Users\user\AppData\Roaming\...\run.dat, data 18->39 dropped 41 C:\Users\user\AppData\Local\...\tmpE75C.tmp, XML 18->41 dropped 43 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 18->43 dropped 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->57 29 schtasks.exe 1 18->29         started        31 schtasks.exe 1 18->31         started        file8 signatures9 process10 process11 33 conhost.exe 29->33         started        35 conhost.exe 31->35         started       

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    8249boAXzf.exe32%ReversingLabsWin32.Trojan.Pwsx
    8249boAXzf.exe37%VirustotalBrowse
    8249boAXzf.exe100%Joe Sandbox ML

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe100%Joe Sandbox ML
    C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe32%ReversingLabsWin32.Trojan.Pwsx
    C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe37%VirustotalBrowse

    Unpacked PE Files

    SourceDetectionScannerLabelLinkDownload
    9.2.8249boAXzf.exe.400000.0.unpack100%AviraTR/Dropper.MSIL.Gen7Download File
    1.2.8249boAXzf.exe.5fd0000.21.unpack100%AviraTR/NanoCore.fadteDownload File

    Domains

    SourceDetectionScannerLabelLink
    tzitziklishop.ddns.net12%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
    http://www.tiro.com0%URL Reputationsafe
    http://www.goodfont.co.kr0%URL Reputationsafe
    http://www.carterandcone.coml0%URL Reputationsafe
    http://www.sajatypeworks.com0%URL Reputationsafe
    http://www.typography.netD0%URL Reputationsafe
    http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
    http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
    http://fontfabrik.com0%URL Reputationsafe
    http://www.founder.com.cn/cn0%URL Reputationsafe
    http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
    http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
    http://www.sandoll.co.kr0%URL Reputationsafe
    http://www.urwpp.deDPlease0%URL Reputationsafe
    http://www.zhongyicts.com.cn0%URL Reputationsafe
    http://www.sakkal.com0%URL Reputationsafe
    tzitziklishop.ddns.net12%VirustotalBrowse
    127.0.0.10%Avira URL Cloudsafe
    tzitziklishop.ddns.net100%Avira URL Cloudmalware
    127.0.0.11%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    tzitziklishop.ddns.net
    		45.12.253.26
    		truetrueunknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    tzitziklishop.ddns.nettrue
    • 12%, Virustotal, Browse
    • Avira URL Cloud: malware
    		unknown
    127.0.0.1true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.apache.org/licenses/LICENSE-2.08249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
      		high
      http://www.fontbureau.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
        		high
        http://www.fontbureau.com/designersG8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://www.fontbureau.com/designers/?8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://www.founder.com.cn/cn/bThe8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://www.fontbureau.com/designers?8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://www.tiro.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              http://www.fontbureau.com/designers8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://www.goodfont.co.kr8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://google.com8249boAXzf.exe, 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, 8249boAXzf.exe, 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.carterandcone.coml8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.sajatypeworks.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.typography.netD8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.fontbureau.com/designers/cabarga.htmlN8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.founder.com.cn/cn/cThe8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.galapagosdesign.com/staff/dennis.htm8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://fontfabrik.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.founder.com.cn/cn8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers/frere-user.html8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://www.jiyu-kobo.co.jp/8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.galapagosdesign.com/DPlease8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers88249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.fonts.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.sandoll.co.kr8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.urwpp.deDPlease8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.zhongyicts.com.cn8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name8249boAXzf.exe, 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.sakkal.com8249boAXzf.exe, 00000000.00000002.366180593.00000000069C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            45.12.253.26
                            		tzitziklishop.ddns.netGermany
                            		33657CMCSUStrue

                            General Information

                            Joe Sandbox Version:36.0.0 Rainbow Opal
                            Analysis ID:798193
                            Start date and time:2023-02-03 20:49:59 +01:00
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 11m 7s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:17
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample file name:8249boAXzf.exe
                            Detection:MAL
                            Classification:mal100.troj.evad.winEXE@18/11@13/1
                            EGA Information:
                            • Successful, ratio: 100%
                            HDC Information:Failed
                            HCA Information:
                            • Successful, ratio: 94%
                            • Number of executed functions: 42
                            • Number of non-executed functions: 9
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
                            • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                            • Report size getting too big, too many NtDeviceIoControlFile calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            20:51:05API Interceptor841x Sleep call for process: 8249boAXzf.exe modified
                            20:51:12Task SchedulerRun new task: DHCP Monitor path: "C:\Users\user\Desktop\8249boAXzf.exe" s>$(Arg0)
                            20:51:12AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                            20:51:18Task SchedulerRun new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
                            20:51:25API Interceptor2x Sleep call for process: dhcpmon.exe modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            45.12.253.263yIxxU5Wko.exeGet hashmaliciousBrowse
                              kcnXZ6yXoo.exeGet hashmaliciousBrowse
                                nzCzLT1rR6.exeGet hashmaliciousBrowse
                                  wvkLXKZ8u4.exeGet hashmaliciousBrowse
                                    tM2hiDXHII.exeGet hashmaliciousBrowse
                                      ugg75Xp5Ly.exeGet hashmaliciousBrowse
                                        jkbRdmvpYk.exeGet hashmaliciousBrowse
                                          97J0yOg7xE.exeGet hashmaliciousBrowse

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            tzitziklishop.ddns.net3yIxxU5Wko.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            kcnXZ6yXoo.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            nzCzLT1rR6.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            wvkLXKZ8u4.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            tM2hiDXHII.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            ugg75Xp5Ly.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            jkbRdmvpYk.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            97J0yOg7xE.exeGet hashmaliciousBrowse
                                            • 45.12.253.26
                                            9xfmAn7tia.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            AZTEEjjb81.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            dsTz6BOMBc.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            l1yIVNqWbL.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            PAPp2Htw2l.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            fn84Sa6oxP.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            1rCwiABNIs.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            2XFxeuktGo.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            2OBeC7PLQA.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            5HypDdgylj.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            file.exeGet hashmaliciousBrowse
                                            • 194.180.48.197
                                            T1M66eTV7y.exeGet hashmaliciousBrowse
                                            • 194.180.48.197

                                            ASNs

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            CMCSUS1E4O4wvUNI.exeGet hashmaliciousBrowse
                                            • 171.22.30.147
                                            YIMG7ShDu6.exeGet hashmaliciousBrowse
                                            • 171.22.30.147
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            kellyzx.exeGet hashmaliciousBrowse
                                            • 171.22.30.147
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56
                                            file.exeGet hashmaliciousBrowse
                                            • 45.12.253.56

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Category:dropped
                                            Size (bytes):881664
                                            Entropy (8bit):7.640232654729335
                                            Encrypted:false
                                            SSDEEP:12288:ThefaqG4yPaJ6Fy2Mxzo3ZuJ+ZKoz+ZpCs83seI13+OZAMMOk:1eSqG4yPaJ6F0xMzZKssX+5
                                            MD5:B6C9E205BBE4752D743E4F49588BF35C
                                            SHA1:DCA5D1249746A9C95E78AD6F1C71B9598081B895
                                            SHA-256:3B9B213448C7D1D3B5B9F9C19CDAD35E6215AF54E1E2E4995A74877F02BF8E0A
                                            SHA-512:DE52A84FF5B9A07FE0E02E5A96543AED5871565FA117B40F46A90C83581D6AA83A2C02127756F1D78803A6E0865083D77993725848D87CD09717CC6E368BEB88
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            • Antivirus: ReversingLabs, Detection: 32%
                                            • Antivirus: Virustotal, Detection: 37%, Browse
                                            Reputation:low
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............0..l............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....j... ...l.................. ..`.rsrc................n..............@..@.reloc...............r..............@..B.......................H...........U..............0.............................................(.......s....}.....{.....{....o.....*&...}....*N..r...p.(....}....*....0..[.........{.....{....o.......{.....{....s....}....s......{....o......{.....o....&.{....o ......+..*..0..L........s!......{....o".....r%..po#.....o$...rX..p.s%...o&...&.o$...r`..p..s%...o&...&.o$...rv..p..s%...o&...&.o$...r...p.s%...o&...&.o$...r...p..s%...o&...&.o$...rX..po'....o"....A...o(.....o$...r`..po'....o$...o(.....o$...rv.

                                            C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe:Zone.Identifier

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):26
                                            Entropy (8bit):3.95006375643621
                                            Encrypted:false
                                            SSDEEP:3:ggPYV:rPYV
                                            MD5:187F488E27DB4AF347237FE461A079AD
                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                            Malicious:true
                                            Reputation:high, very likely benign file
                                            Preview:[ZoneTransfer]....ZoneId=0

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8249boAXzf.exe.log

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:true
                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log

                                            Download File
                                            Process:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:false
                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                            C:\Users\user\AppData\Local\Temp\tmpE75C.tmp

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1300
                                            Entropy (8bit):5.120535101378634
                                            Encrypted:false
                                            SSDEEP:24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0YGxxtn:cbk4oL600QydbQxIYODOLedq3sj
                                            MD5:38B5D5F445DD4D41085BA68A02BFAA52
                                            SHA1:68CA940E740899B21D32340037A79B5B5D8569E3
                                            SHA-256:20D67878EE6CEC85678F2F359C4B146A991B4224D5D5E309B4F521A17EC201B1
                                            SHA-512:34974933B519A4D9F48A541247FE97FAC268D648248A2C4EA7C448BE50BFC236C1F2A2BFF17EF0FBD924C12881CD5D8606151D2B667D1C5EB763C1D5DD2DE23E
                                            Malicious:true
                                            Preview:<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

                                            C:\Users\user\AppData\Local\Temp\tmpE922.tmp

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1310
                                            Entropy (8bit):5.109425792877704
                                            Encrypted:false
                                            SSDEEP:24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
                                            MD5:5C2F41CFC6F988C859DA7D727AC2B62A
                                            SHA1:68999C85FC7E37BAB9216E0099836D40D4545C1C
                                            SHA-256:98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
                                            SHA-512:B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
                                            Malicious:false
                                            Preview:<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

                                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):232
                                            Entropy (8bit):7.024371743172393
                                            Encrypted:false
                                            SSDEEP:6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
                                            MD5:32D0AAE13696FF7F8AF33B2D22451028
                                            SHA1:EF80C4E0DB2AE8EF288027C9D3518E6950B583A4
                                            SHA-256:5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
                                            SHA-512:1D77FC13512C0DBC4EFD7A66ACB502481E4EFA0FB73D0C7D0942448A72B9B05BA1EA78DDF0BE966363C2E3122E0B631DB7630D044D08C1E1D32B9FB025C356A5
                                            Malicious:false
                                            Preview:Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.

                                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):8
                                            Entropy (8bit):2.75
                                            Encrypted:false
                                            SSDEEP:3:njSn:nu
                                            MD5:ECEAE678ACCCCE03BE11C5B9508DF48B
                                            SHA1:8EB67EDA154102AE5651174B07DD09DD638A6156
                                            SHA-256:FAC97843E83CC671F15C7F95427B6F409F0317B8E2737AE0CA361EFF62BF671B
                                            SHA-512:998D0915C3EB33660456AADF3C69CB1912DFACFFC5B8A85EBB6D9E49199549B6A069D38AC53724BF4BE58B42869DF1C329D8CDA3F58A6458370F1C195B941336
                                            Malicious:true
                                            Preview:?......H

                                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:data
                                            Category:modified
                                            Size (bytes):40
                                            Entropy (8bit):5.221928094887364
                                            Encrypted:false
                                            SSDEEP:3:9bzY6oRDMjmPl:RzWDMCd
                                            MD5:AE0F5E6CE7122AF264EC533C6B15A27B
                                            SHA1:1265A495C42EED76CC043D50C60C23297E76CCE1
                                            SHA-256:73B0B92179C61C26589B47E9732CE418B07EDEE3860EE5A2A5FB06F3B8AA9B26
                                            SHA-512:DD44C2D24D4E3A0F0B988AD3D04683B5CB128298043134649BBE33B2512CE0C9B1A8E7D893B9F66FBBCDD901E2B0646C4533FB6C0C8C4AFCB95A0EFB95D446F8
                                            Malicious:false
                                            Preview:9iH...}Z.4..f..... 8.j....|.&X..e.F.*.

                                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):327432
                                            Entropy (8bit):7.99938831605763
                                            Encrypted:true
                                            SSDEEP:6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
                                            MD5:7E8F4A764B981D5B82D1CC49D341E9C6
                                            SHA1:D9F0685A028FB219E1A6286AEFB7D6FCFC778B85
                                            SHA-256:0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
                                            SHA-512:880E46504FCFB4B15B86B9D8087BA88E6C4950E433616EBB637799F42B081ABF6F07508943ECB1F786B2A89E751F5AE62D750BDCFFDDF535D600CF66EC44E926
                                            Malicious:false
                                            Preview:pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.)*.....{B.[...y%.*..i.Q.<..xt.X..H.. ..HF7g...I.*3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^*I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.|i4...i...;O...n.?.,. ....v?.5}.OY@.dG|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`|.B....3.....I..o...u1..8i=.z.W..7

                                            C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat

                                            Download File
                                            Process:C:\Users\user\Desktop\8249boAXzf.exe
                                            File Type:ASCII text, with no line terminators
                                            Category:dropped
                                            Size (bytes):37
                                            Entropy (8bit):4.334736393288403
                                            Encrypted:false
                                            SSDEEP:3:oNt+WfWdXw9l:oNwvi9l
                                            MD5:0E5F6C691D99A01B3D90BFAD0D0F6A01
                                            SHA1:18ACBBEF100322C09C3CAC9AF170D76737B139D0
                                            SHA-256:47C73173868729CF189A71ABC619C5158C03FDC0E298DA7CAFC2299A3619643A
                                            SHA-512:0EE2ED70FC4F0FD33F429787B930D5DF32BB8028ABDB72C3CC5E0CB30FB757D175DE0C9676DB723B8C70E92DD4F5C9F6E158D379878A62FC11C991879D2B4D93
                                            Malicious:false
                                            Preview:C:\Users\user\Desktop\8249boAXzf.exe

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Entropy (8bit):7.640232654729335
                                            TrID:
                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                            • DOS Executable Generic (2002/1) 0.01%
                                            File name:8249boAXzf.exe
                                            File size:881664
                                            MD5:b6c9e205bbe4752d743e4f49588bf35c
                                            SHA1:dca5d1249746a9c95e78ad6f1c71b9598081b895
                                            SHA256:3b9b213448c7d1d3b5b9f9c19cdad35e6215af54e1e2e4995a74877f02bf8e0a
                                            SHA512:de52a84ff5b9a07fe0e02e5a96543aed5871565fa117b40f46a90c83581d6aa83a2c02127756f1d78803a6e0865083d77993725848d87cd09717cc6e368beb88
                                            SSDEEP:12288:ThefaqG4yPaJ6Fy2Mxzo3ZuJ+ZKoz+ZpCs83seI13+OZAMMOk:1eSqG4yPaJ6F0xMzZKssX+5
                                            TLSH:93159E6337B099B2F78720B604387A885BF17513BE16E2938B7737C06785DB772A8152
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............0..l............... ........@.. ....................................@................................

                                            File Icon

                                            Icon Hash:00828e8e8686b000

                                            Static PE Info

                                            General

                                            Entrypoint:0x4d8a0a
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                            Time Stamp:0x63DCE9E2 [Fri Feb 3 11:02:58 2023 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                            Entrypoint Preview

                                            Instruction
                                            jmp dword ptr [00402000h]
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xd89b80x4f.text
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xda0000x384.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0xdc0000xc.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x20000xd6a100xd6c00False0.7746596241996507data7.645229548325504IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                            .rsrc0xda0000x3840x400False0.3857421875data2.8721792556390318IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0xdc0000xc0x200False0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_VERSION0xda0580x328data

                                            Imports

                                            DLLImport
                                            mscoree.dll_CorExeMain

                                            Network Behavior

                                            Snort IDS Alerts

                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                            192.168.2.445.12.253.264969716652816766 02/03/23-20:51:34.809216TCP2816766ETPRO TROJAN NanoCore RAT CnC 7496971665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969916652816718 02/03/23-20:52:00.320309TCP2816718ETPRO TROJAN NanoCore RAT Keep-Alive Beacon496991665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969916652025019 02/03/23-20:51:59.365399TCP2025019ET TROJAN Possible NanoCore C2 60B496991665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969616652025019 02/03/23-20:51:19.153314TCP2025019ET TROJAN Possible NanoCore C2 60B496961665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970716652025019 02/03/23-20:52:53.744703TCP2025019ET TROJAN Possible NanoCore C2 60B497071665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970316652025019 02/03/23-20:52:24.202333TCP2025019ET TROJAN Possible NanoCore C2 60B497031665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969816652025019 02/03/23-20:51:52.381168TCP2025019ET TROJAN Possible NanoCore C2 60B496981665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969616652816766 02/03/23-20:51:21.438493TCP2816766ETPRO TROJAN NanoCore RAT CnC 7496961665192.168.2.445.12.253.26
                                            45.12.253.26192.168.2.41665497082841753 02/03/23-20:53:00.690723TCP2841753ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)16654970845.12.253.26192.168.2.4
                                            192.168.2.445.12.253.264970516652816766 02/03/23-20:52:38.060859TCP2816766ETPRO TROJAN NanoCore RAT CnC 7497051665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970616652025019 02/03/23-20:52:43.731524TCP2025019ET TROJAN Possible NanoCore C2 60B497061665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970216652025019 02/03/23-20:52:17.969073TCP2025019ET TROJAN Possible NanoCore C2 60B497021665192.168.2.445.12.253.26
                                            45.12.253.26192.168.2.41665496972841753 02/03/23-20:51:33.287370TCP2841753ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)16654969745.12.253.26192.168.2.4
                                            45.12.253.26192.168.2.41665497012841753 02/03/23-20:52:13.290690TCP2841753ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)16654970145.12.253.26192.168.2.4
                                            192.168.2.445.12.253.264969716652025019 02/03/23-20:51:28.080721TCP2025019ET TROJAN Possible NanoCore C2 60B496971665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970816652025019 02/03/23-20:53:00.640434TCP2025019ET TROJAN Possible NanoCore C2 60B497081665192.168.2.445.12.253.26
                                            45.12.253.26192.168.2.41665497042841753 02/03/23-20:52:31.335061TCP2841753ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)16654970445.12.253.26192.168.2.4
                                            192.168.2.445.12.253.264969916652816766 02/03/23-20:52:00.320309TCP2816766ETPRO TROJAN NanoCore RAT CnC 7496991665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970516652025019 02/03/23-20:52:36.965086TCP2025019ET TROJAN Possible NanoCore C2 60B497051665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970016652816766 02/03/23-20:52:07.473582TCP2816766ETPRO TROJAN NanoCore RAT CnC 7497001665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970616652816766 02/03/23-20:52:45.300274TCP2816766ETPRO TROJAN NanoCore RAT CnC 7497061665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970116652025019 02/03/23-20:52:13.244304TCP2025019ET TROJAN Possible NanoCore C2 60B497011665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970416652025019 02/03/23-20:52:31.301944TCP2025019ET TROJAN Possible NanoCore C2 60B497041665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264969816652816766 02/03/23-20:51:54.258053TCP2816766ETPRO TROJAN NanoCore RAT CnC 7496981665192.168.2.445.12.253.26
                                            45.12.253.26192.168.2.41665496982810290 02/03/23-20:51:53.335571TCP2810290ETPRO TROJAN NanoCore RAT Keepalive Response 116654969845.12.253.26192.168.2.4
                                            192.168.2.445.12.253.264970716652816766 02/03/23-20:52:55.548418TCP2816766ETPRO TROJAN NanoCore RAT CnC 7497071665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970016652025019 02/03/23-20:52:05.685748TCP2025019ET TROJAN Possible NanoCore C2 60B497001665192.168.2.445.12.253.26
                                            192.168.2.445.12.253.264970316652816766 02/03/23-20:52:25.242824TCP2816766ETPRO TROJAN NanoCore RAT CnC 7497031665192.168.2.445.12.253.26

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Feb 3, 2023 20:51:18.855530024 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:18.887409925 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:18.887561083 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.153314114 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.231271982 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.267807961 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.303603888 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.347841978 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.375394106 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.551295042 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.638710976 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.706734896 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.706783056 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.706810951 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.706837893 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.706888914 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.706940889 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.733835936 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.733884096 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.733910084 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.733935118 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.733958960 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.733983040 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.734009027 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.734035015 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.734189034 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.761039972 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761085033 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761112928 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761132956 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761153936 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761173964 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761203051 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761229992 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761281967 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761284113 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.761307955 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761333942 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761343002 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.761360884 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.761367083 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.761435986 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.787961960 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788012028 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788039923 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788058996 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788083076 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788110018 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788126945 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788132906 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788151979 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788177967 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788189888 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788203001 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788208961 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788233042 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788253069 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788258076 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788283110 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788304090 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788305998 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788335085 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788357973 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788372040 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788384914 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788408995 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788409948 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788434029 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788458109 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788485050 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788492918 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788511992 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788522005 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.788538933 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.788547993 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.906279087 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.938882113 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.938941956 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.939104080 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:19.974792957 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:19.974977016 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.002440929 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.002536058 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029227018 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029365063 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029427052 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029573917 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029613018 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029614925 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029669046 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029674053 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029704094 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029712915 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029727936 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029738903 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029747963 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029772997 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029774904 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029807091 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029815912 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029845953 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029853106 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029875040 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029916048 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029916048 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029916048 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029949903 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029953003 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.029978991 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.029987097 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030008078 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030018091 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030038118 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030045033 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030069113 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030073881 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030100107 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030107021 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030128956 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030134916 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030158043 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030163050 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030188084 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030191898 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030217886 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030227900 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030247927 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030276060 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030281067 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030303955 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030320883 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030332088 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030348063 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030369043 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.030380011 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.030421019 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.084218025 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.084259987 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.084290028 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.084299088 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.084319115 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.084325075 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.084355116 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.084371090 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.313035965 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.374960899 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.375106096 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.403693914 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.403732061 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.403784037 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.403821945 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.430495024 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.430531025 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.430562019 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.430588007 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.430634022 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.430702925 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458153009 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458199978 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458226919 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458240986 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458240986 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458261013 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458293915 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458298922 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458313942 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458334923 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.458365917 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.458385944 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.488883018 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.488920927 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.488949060 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.488975048 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.489002943 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.489032030 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.489032984 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.489061117 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.489087105 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.489101887 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.489101887 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.489103079 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.489103079 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.489207983 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.516736031 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516788960 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516820908 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516849041 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516877890 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516908884 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516940117 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516968966 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.516997099 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517024994 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517052889 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517081022 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517103910 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517126083 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.517168999 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.517415047 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553325891 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553364992 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553384066 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553401947 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553421021 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553426981 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553440094 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553461075 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553481102 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553488970 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553499937 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553510904 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553520918 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553524971 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553539991 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553559065 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553579092 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553584099 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553599119 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553606033 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.553620100 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.553647041 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580507040 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580547094 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580573082 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580599070 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580610991 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580626011 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580651999 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580655098 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580677986 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580683947 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580703974 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580717087 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580730915 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580754995 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580780029 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580805063 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580806017 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580831051 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580832005 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580856085 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580882072 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.580893993 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.580924988 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.607878923 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.607924938 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.607959032 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.607997894 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608035088 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608046055 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608067036 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608086109 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608108997 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608110905 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608139992 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608170033 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608181000 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608201027 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608231068 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608268976 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608273029 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608306885 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608310938 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608338118 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608369112 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608397961 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.608407974 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608438015 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.608438969 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635730982 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635777950 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635808945 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635839939 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635869980 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635868073 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.635901928 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635930061 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.635930061 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.635936022 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635972023 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.635997057 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.636004925 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636038065 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636063099 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636073112 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.636094093 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636116028 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.636125088 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636157036 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636185884 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636198997 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.636218071 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.636271954 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665155888 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665225029 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665258884 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665292978 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665318966 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665326118 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665359020 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665376902 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665395021 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665426970 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665461063 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665493011 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665496111 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665524960 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665533066 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665558100 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665574074 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665591002 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665623903 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665657043 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665658951 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665688992 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665719986 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665750027 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.665751934 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.665779114 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.692850113 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692897081 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692915916 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692934990 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692955017 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692975044 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.692972898 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.692996979 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693017006 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693036079 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693051100 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.693056107 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693077087 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693094969 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693104029 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.693114996 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693134069 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693151951 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693166018 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.693166018 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.693170071 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693188906 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693197966 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.693207979 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.693274975 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721539974 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721577883 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721599102 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721617937 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721637964 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721657991 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721677065 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721694946 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721714020 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721724987 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721731901 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721751928 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721772909 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721791983 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721797943 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721811056 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721829891 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721847057 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721848965 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721869946 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721884966 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721889019 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721910000 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721929073 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.721931934 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.721971035 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.748661041 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748729944 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748756886 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748785019 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748811007 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748836994 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748867035 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748893976 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748899937 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.748922110 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748946905 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748974085 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.748995066 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.749000072 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749027967 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749054909 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749063015 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.749080896 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749090910 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.749106884 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749133110 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749156952 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.749157906 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749185085 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749209881 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.749217033 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.749259949 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.775789976 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775824070 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775844097 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775861979 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775882006 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775883913 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.775902033 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775922060 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775938034 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.775943041 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775969028 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775986910 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.775990009 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776005983 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776019096 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776026011 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776046038 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776065111 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776074886 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776083946 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776103973 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776117086 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776123047 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776137114 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776144028 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776164055 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776181936 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776185989 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776207924 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776222944 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.776230097 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.776258945 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.803426027 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.803459883 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.803479910 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:20.803555012 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:20.803607941 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:21.438493013 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:21.524494886 CET16654969645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:22.425739050 CET496961665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.043800116 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.080049992 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:28.080203056 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.080720901 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.164896965 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:28.212008953 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:28.257445097 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.285089016 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:28.360169888 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.761987925 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:28.850761890 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:28.918086052 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.010687113 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.015722990 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.063296080 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.089776039 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.172703981 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.200026035 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.360554934 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.576093912 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.578248978 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.665438890 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.672710896 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.713203907 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.745821953 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.763745070 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.791297913 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:29.862737894 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.895719051 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:29.978141069 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:30.521002054 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:30.602581978 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:30.602679968 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:30.680990934 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:33.287369967 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:33.360629082 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:34.693335056 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:34.775890112 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:34.809216022 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:34.884704113 CET16654969745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:35.709022045 CET496971665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.304850101 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.333892107 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:52.334100962 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.381167889 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.462651014 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:52.486927032 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:52.674786091 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.704039097 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.731621027 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:52.776670933 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:52.856966972 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:52.982202053 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.058022022 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.062910080 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.083750010 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.114186049 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.174772978 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.202903986 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.280231953 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.307246923 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.307334900 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.335571051 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:53.335725069 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:53.415045023 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:54.032412052 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:54.174802065 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:54.258053064 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:54.337147951 CET16654969845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:55.286382914 CET496981665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.337680101 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.364613056 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.364831924 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.365398884 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.461858034 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.471646070 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.471972942 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.501303911 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.521790028 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.606612921 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.775974035 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.777312040 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.814969063 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.909759998 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.936512947 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.936978102 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.964740992 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:51:59.966559887 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:51:59.994067907 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:00.112847090 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:00.320308924 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:00.399868965 CET16654969945.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:01.594818115 CET496991665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.648900032 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.675714970 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:05.675913095 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.685748100 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.774806023 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:05.824467897 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:05.824790001 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.862015963 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:05.870167017 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:05.947875023 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.149276972 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.155694008 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.182626963 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.222731113 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.254250050 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.300796986 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.328098059 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.328437090 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.355211020 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.355350971 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.382956028 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:06.425859928 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.459507942 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:06.540182114 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:07.473582029 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:07.555602074 CET16654970045.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:09.163034916 CET497001665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.215982914 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.243669033 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.243885994 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.244303942 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.290689945 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.379554033 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.406306028 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.406600952 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.434441090 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.454538107 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.542584896 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.702151060 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.703228951 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.730072975 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.785860062 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.822586060 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.845246077 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.873500109 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.878573895 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.880556107 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:13.906008959 CET16654970145.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:13.906155109 CET497011665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:17.940834999 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:17.968240023 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:17.968343973 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:17.969073057 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.055480003 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.070792913 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.071105957 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.100990057 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.109462976 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.197554111 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.326558113 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.327308893 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.354530096 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.395667076 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.448952913 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.479680061 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.514707088 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.567493916 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.627003908 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.656014919 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.656126976 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:18.686788082 CET16654970245.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:18.727231026 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:19.026349068 CET497021665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.171380043 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.198051929 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.201862097 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.202332973 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.275403023 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.281589031 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.282175064 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.315346956 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.329585075 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.415699005 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.531481028 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.533305883 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.559931040 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.614907980 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.689040899 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.719753981 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.746921062 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.747303009 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.775590897 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.775880098 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:24.803273916 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:24.849610090 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:25.242824078 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:25.336779118 CET16654970345.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:26.324084044 CET497031665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.274060965 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.301270008 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.301388979 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.301944017 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.335061073 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.381092072 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.454705000 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.454971075 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.482136011 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.489984035 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.571419001 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.793387890 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.795550108 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.822432995 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.881171942 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.907999992 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.909307957 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.937661886 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:31.937879086 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:31.965063095 CET16654970445.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:32.069292068 CET497041665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:36.779808044 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:36.806190968 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:36.806343079 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:36.965085983 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.057312965 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.074407101 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.095938921 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.138303041 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.178407907 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.485343933 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.571171999 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.729214907 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.772248030 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.800204992 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.850363970 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.901395082 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:37.918121099 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.935314894 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:37.935453892 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:38.060858965 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:38.133658886 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:38.133794069 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:38.161412954 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:38.209728003 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:38.236067057 CET16654970545.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:38.287882090 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:39.311383009 CET497051665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.701780081 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.730839968 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:43.731086016 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.731523991 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.807149887 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:43.846276045 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:43.846740007 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.874252081 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:43.881406069 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:43.970890045 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.137598038 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.138283014 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.167138100 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.184598923 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.280982018 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.326124907 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.365844011 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.392538071 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.392828941 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.422610044 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.422756910 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.456186056 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.507191896 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:44.626821041 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:44.679076910 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:45.300273895 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:45.383610010 CET16654970645.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:46.823000908 CET497061665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.716267109 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.743793964 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:53.744138956 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.744703054 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.836750984 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:53.842439890 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:53.842834949 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.873914957 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:53.896048069 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:53.984086037 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.136295080 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.141563892 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.168253899 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.385262966 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.412072897 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.414244890 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.441724062 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.441930056 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.468946934 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.469140053 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.572108984 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:54.572271109 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:54.649339914 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:55.548418045 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:52:55.633693933 CET16654970745.12.253.26192.168.2.4
                                            Feb 3, 2023 20:52:56.567152023 CET497071665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.612099886 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.638911963 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:00.639905930 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.640434027 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.690722942 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:00.731328964 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.791075945 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:00.795022964 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.822755098 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:00.834959984 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:00.919173956 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.078248978 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.080557108 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.113137007 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.168936968 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.283274889 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.330977917 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.357800961 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.361067057 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.389149904 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.390842915 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.417855978 CET16654970845.12.253.26192.168.2.4
                                            Feb 3, 2023 20:53:01.465771914 CET497081665192.168.2.445.12.253.26
                                            Feb 3, 2023 20:53:01.624097109 CET497081665192.168.2.445.12.253.26

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Feb 3, 2023 20:51:18.796379089 CET5968353192.168.2.48.8.8.8
                                            Feb 3, 2023 20:51:18.816047907 CET53596838.8.8.8192.168.2.4
                                            Feb 3, 2023 20:51:28.017151117 CET6416753192.168.2.48.8.8.8
                                            Feb 3, 2023 20:51:28.034809113 CET53641678.8.8.8192.168.2.4
                                            Feb 3, 2023 20:51:52.212671995 CET5856553192.168.2.48.8.8.8
                                            Feb 3, 2023 20:51:52.232932091 CET53585658.8.8.8192.168.2.4
                                            Feb 3, 2023 20:51:59.317153931 CET5223953192.168.2.48.8.8.8
                                            Feb 3, 2023 20:51:59.336599112 CET53522398.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:05.628617048 CET5680753192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:05.646897078 CET53568078.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:13.190443993 CET6100753192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:13.209311962 CET53610078.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:17.913726091 CET6068653192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:17.933197021 CET53606868.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:24.150405884 CET6112453192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:24.169990063 CET53611248.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:31.254399061 CET5944453192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:31.271951914 CET53594448.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:36.682894945 CET5557053192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:36.702562094 CET53555708.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:43.561836958 CET6490653192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:43.579523087 CET53649068.8.8.8192.168.2.4
                                            Feb 3, 2023 20:52:53.697514057 CET5944653192.168.2.48.8.8.8
                                            Feb 3, 2023 20:52:53.715249062 CET53594468.8.8.8192.168.2.4
                                            Feb 3, 2023 20:53:00.589956999 CET5086153192.168.2.48.8.8.8
                                            Feb 3, 2023 20:53:00.610073090 CET53508618.8.8.8192.168.2.4

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            Feb 3, 2023 20:51:18.796379089 CET192.168.2.48.8.8.80x4b9bStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:28.017151117 CET192.168.2.48.8.8.80x263dStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:52.212671995 CET192.168.2.48.8.8.80x3701Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:59.317153931 CET192.168.2.48.8.8.80xb96aStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:05.628617048 CET192.168.2.48.8.8.80xd148Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:13.190443993 CET192.168.2.48.8.8.80x829aStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:17.913726091 CET192.168.2.48.8.8.80x7b86Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:24.150405884 CET192.168.2.48.8.8.80x1043Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:31.254399061 CET192.168.2.48.8.8.80x701dStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:36.682894945 CET192.168.2.48.8.8.80xae84Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:43.561836958 CET192.168.2.48.8.8.80xf74eStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:53.697514057 CET192.168.2.48.8.8.80xa5aeStandard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:53:00.589956999 CET192.168.2.48.8.8.80xb895Standard query (0)tzitziklishop.ddns.netA (IP address)IN (0x0001)false

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            Feb 3, 2023 20:51:18.816047907 CET8.8.8.8192.168.2.40x4b9bNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:28.034809113 CET8.8.8.8192.168.2.40x263dNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:52.232932091 CET8.8.8.8192.168.2.40x3701No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:51:59.336599112 CET8.8.8.8192.168.2.40xb96aNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:05.646897078 CET8.8.8.8192.168.2.40xd148No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:13.209311962 CET8.8.8.8192.168.2.40x829aNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:17.933197021 CET8.8.8.8192.168.2.40x7b86No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:24.169990063 CET8.8.8.8192.168.2.40x1043No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:31.271951914 CET8.8.8.8192.168.2.40x701dNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:36.702562094 CET8.8.8.8192.168.2.40xae84No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:43.579523087 CET8.8.8.8192.168.2.40xf74eNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:52:53.715249062 CET8.8.8.8192.168.2.40xa5aeNo error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false
                                            Feb 3, 2023 20:53:00.610073090 CET8.8.8.8192.168.2.40xb895No error (0)tzitziklishop.ddns.net45.12.253.26A (IP address)IN (0x0001)false

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Target ID:0
                                            Start time:20:50:57
                                            Start date:03/02/2023
                                            Path:C:\Users\user\Desktop\8249boAXzf.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Users\user\Desktop\8249boAXzf.exe
                                            Imagebase:0x4d0000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.342245474.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.337798230.0000000002AB7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            Reputation:low

                                            General

                                            Target ID:1
                                            Start time:20:51:07
                                            Start date:03/02/2023
                                            Path:C:\Users\user\Desktop\8249boAXzf.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Users\user\Desktop\8249boAXzf.exe
                                            Imagebase:0x600000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.608743272.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.612725792.0000000007080000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.610002731.00000000064F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: NanoCore, Description: unknown, Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.583394625.0000000002BCD000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.612800982.0000000007090000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.613896406.0000000007120000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.607275992.0000000005200000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.608258227.0000000005D70000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: NanoCore, Description: unknown, Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.595827703.0000000004676000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.613406938.00000000070E0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.613015352.00000000070B0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.613288748.00000000070D0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000003.363835446.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.595827703.0000000004430000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.612644717.0000000007070000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.612920586.00000000070A0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.612520535.0000000007060000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.607909764.0000000005D20000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.595827703.0000000004761000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.595827703.0000000004600000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000001.00000002.583394625.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            Reputation:low

                                            General

                                            Target ID:2
                                            Start time:20:51:11
                                            Start date:03/02/2023
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:schtasks.exe" /create /f /tn "DHCP Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmpE75C.tmp
                                            Imagebase:0x10c0000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:3
                                            Start time:20:51:11
                                            Start date:03/02/2023
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7c72c0000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:4
                                            Start time:20:51:12
                                            Start date:03/02/2023
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:schtasks.exe" /create /f /tn "DHCP Monitor Task" /xml "C:\Users\user\AppData\Local\Temp\tmpE922.tmp
                                            Imagebase:0x10c0000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:5
                                            Start time:20:51:12
                                            Start date:03/02/2023
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff7c72c0000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:6
                                            Start time:20:51:13
                                            Start date:03/02/2023
                                            Path:C:\Users\user\Desktop\8249boAXzf.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Users\user\Desktop\8249boAXzf.exe 0
                                            Imagebase:0x5c0000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Reputation:low

                                            General

                                            Target ID:7
                                            Start time:20:51:18
                                            Start date:03/02/2023
                                            Path:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Wow64 process (32bit):true
                                            Commandline:"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" 0
                                            Imagebase:0x190000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000007.00000002.396207868.00000000026C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            Antivirus matches:
                                            • Detection: 100%, Joe Sandbox ML
                                            • Detection: 32%, ReversingLabs
                                            • Detection: 37%, Virustotal, Browse
                                            Reputation:low

                                            General

                                            Target ID:8
                                            Start time:20:51:20
                                            Start date:03/02/2023
                                            Path:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Wow64 process (32bit):true
                                            Commandline:"C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe"
                                            Imagebase:0x690000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:.Net C# or VB.NET
                                            Reputation:low

                                            General

                                            Target ID:9
                                            Start time:20:51:29
                                            Start date:03/02/2023
                                            Path:C:\Users\user\Desktop\8249boAXzf.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Users\user\Desktop\8249boAXzf.exe
                                            Imagebase:0x5d0000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000009.00000002.420774384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000009.00000002.437533426.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000009.00000002.436310288.00000000029B1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            Reputation:low

                                            General

                                            Target ID:10
                                            Start time:20:51:30
                                            Start date:03/02/2023
                                            Path:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Imagebase:0xb10000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                            • Rule: NanoCore, Description: unknown, Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 0000000A.00000002.436970886.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 0000000A.00000002.438174949.0000000003F18000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                            Reputation:low

                                            General

                                            Target ID:11
                                            Start time:20:51:40
                                            Start date:03/02/2023
                                            Path:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
                                            Imagebase:0xd90000
                                            File size:881664 bytes
                                            MD5 hash:B6C9E205BBE4752D743E4F49588BF35C
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:.Net C# or VB.NET
                                            Reputation:low

                                            Disassembly

                                            Reset < >

                                              Execution Graph

                                              Execution Coverage:10.8%
                                              Dynamic/Decrypted Code Coverage:100%
                                              Signature Coverage:0%
                                              Total number of Nodes:119
                                              Total number of Limit Nodes:9
                                              execution_graph 19770 8807fd0 19771 880815b 19770->19771 19772 8807ff6 19770->19772 19772->19771 19774 8808250 PostMessageW 19772->19774 19775 88082bc 19774->19775 19775->19772 19894 8807eb0 19895 8807ec5 19894->19895 19898 85daf18 19895->19898 19899 85daf58 VirtualAllocEx 19898->19899 19901 85daf95 19899->19901 19762 bafdb8 19763 bafe20 CreateWindowExW 19762->19763 19765 bafedc 19763->19765 19776 85db008 19777 85db050 WriteProcessMemory 19776->19777 19779 85db0a7 19777->19779 19902 85db128 19903 85db173 ReadProcessMemory 19902->19903 19905 85db1b7 19903->19905 19784 ba40d0 19785 ba40e2 19784->19785 19786 ba40ee 19785->19786 19790 ba41e1 19785->19790 19795 ba3874 19786->19795 19788 ba410d 19791 ba4205 19790->19791 19799 ba42e0 19791->19799 19803 ba42d1 19791->19803 19796 ba387f 19795->19796 19811 ba57f4 19796->19811 19798 ba6ac9 19798->19788 19801 ba4307 19799->19801 19800 ba43e4 19800->19800 19801->19800 19807 ba3cac 19801->19807 19804 ba42e0 19803->19804 19805 ba3cac CreateActCtxA 19804->19805 19806 ba43e4 19804->19806 19805->19806 19808 ba5370 CreateActCtxA 19807->19808 19810 ba5433 19808->19810 19812 ba57ff 19811->19812 19815 ba5814 19812->19815 19814 ba6b75 19814->19798 19816 ba581f 19815->19816 19819 ba5844 19816->19819 19818 ba6c5a 19818->19814 19820 ba584f 19819->19820 19823 ba5874 19820->19823 19822 ba6d4a 19822->19818 19825 ba587f 19823->19825 19824 ba749c 19824->19822 19825->19824 19827 bab370 19825->19827 19829 bab3a1 19827->19829 19828 bab3c5 19828->19824 19829->19828 19832 bab638 19829->19832 19836 bab627 19829->19836 19833 bab645 19832->19833 19834 bab67f 19833->19834 19840 ba9668 19833->19840 19834->19828 19837 bab645 19836->19837 19838 bab67f 19837->19838 19839 ba9668 2 API calls 19837->19839 19838->19828 19839->19838 19841 ba966d 19840->19841 19843 bac378 19841->19843 19844 babf38 19841->19844 19845 babf43 19844->19845 19846 ba5874 2 API calls 19845->19846 19847 bac3e7 19846->19847 19851 bae170 19847->19851 19857 bae158 19847->19857 19848 bac420 19848->19843 19853 bae1a1 19851->19853 19854 bae1ed 19851->19854 19852 bae1ad 19852->19848 19853->19852 19855 bae5f0 LoadLibraryExW GetModuleHandleW 19853->19855 19856 bae5e1 LoadLibraryExW GetModuleHandleW 19853->19856 19854->19848 19855->19854 19856->19854 19858 bae1ed 19857->19858 19860 bae1a1 19857->19860 19858->19848 19859 bae1ad 19859->19848 19860->19859 19861 bae5f0 LoadLibraryExW GetModuleHandleW 19860->19861 19862 bae5e1 LoadLibraryExW GetModuleHandleW 19860->19862 19861->19858 19862->19858 19863 bab750 GetCurrentProcess 19864 bab7ca GetCurrentThread 19863->19864 19865 bab7c3 19863->19865 19866 bab800 19864->19866 19867 bab807 GetCurrentProcess 19864->19867 19865->19864 19866->19867 19868 bab83d 19867->19868 19869 bab865 GetCurrentThreadId 19868->19869 19870 bab896 19869->19870 19871 ba9250 19872 ba925f 19871->19872 19874 ba9750 19871->19874 19875 ba9763 19874->19875 19877 ba977b 19875->19877 19882 ba99d8 19875->19882 19886 ba99d0 19875->19886 19876 ba9773 19876->19877 19878 ba9978 GetModuleHandleW 19876->19878 19877->19872 19879 ba99a5 19878->19879 19879->19872 19883 ba99ec 19882->19883 19884 ba9a11 19883->19884 19890 ba9368 19883->19890 19884->19876 19887 ba99ec 19886->19887 19888 ba9368 LoadLibraryExW 19887->19888 19889 ba9a11 19887->19889 19888->19889 19889->19876 19891 ba9bb8 LoadLibraryExW 19890->19891 19893 ba9c31 19891->19893 19893->19884 19766 baba37 19767 bab9e4 DuplicateHandle 19766->19767 19769 baba42 19766->19769 19768 baba0e 19767->19768 19780 85dad80 19781 85dadc5 SetThreadContext 19780->19781 19783 85dae0d 19781->19783 19906 85db320 19907 85db3a9 CreateProcessA 19906->19907 19909 85db56b 19907->19909 19910 85daca0 19911 85dace0 ResumeThread 19910->19911 19913 85dad11 19911->19913

                                              Executed Functions

                                              Function 00BAB741 Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 00BAB7B0
                                              • GetCurrentThread.KERNEL32 ref: 00BAB7ED
                                              • GetCurrentProcess.KERNEL32 ref: 00BAB82A
                                              • GetCurrentThreadId.KERNEL32 ref: 00BAB883
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 91dd887775007366a88a587828388cb78065a4991ecbe9682fc245a9b61fcc82
                                              • Instruction ID: 0cbb5f276c0b07a8290749c5fd943767987bd83e35f89627a411721941a630ba
                                              • Opcode Fuzzy Hash: 91dd887775007366a88a587828388cb78065a4991ecbe9682fc245a9b61fcc82
                                              • Instruction Fuzzy Hash: C55165B49042498FDB14CFAAD548BEEBBF0EF49304F24819AE019A3251DB785884CF65
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAB750 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 00BAB7B0
                                              • GetCurrentThread.KERNEL32 ref: 00BAB7ED
                                              • GetCurrentProcess.KERNEL32 ref: 00BAB82A
                                              • GetCurrentThreadId.KERNEL32 ref: 00BAB883
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: c35588fd77b2f1250ac750ccadccd05e7f74571a14b72512a125c42a0032aae9
                                              • Instruction ID: 827b9c38831b831701bec9942d587bd15cb7fe4d90b5e3fc9a7a8241520e552f
                                              • Opcode Fuzzy Hash: c35588fd77b2f1250ac750ccadccd05e7f74571a14b72512a125c42a0032aae9
                                              • Instruction Fuzzy Hash: 875154B49002498FDB54CFAAC548BEEBBF5FF48314F24849AE019A3351DB785884CF65
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DB320 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 38 85db320-85db3b5 40 85db3ee-85db40e 38->40 41 85db3b7-85db3c1 38->41 48 85db447-85db476 40->48 49 85db410-85db41a 40->49 41->40 42 85db3c3-85db3c5 41->42 43 85db3e8-85db3eb 42->43 44 85db3c7-85db3d1 42->44 43->40 46 85db3d5-85db3e4 44->46 47 85db3d3 44->47 46->46 50 85db3e6 46->50 47->46 57 85db4af-85db569 CreateProcessA 48->57 58 85db478-85db482 48->58 49->48 51 85db41c-85db41e 49->51 50->43 52 85db441-85db444 51->52 53 85db420-85db42a 51->53 52->48 55 85db42c 53->55 56 85db42e-85db43d 53->56 55->56 56->56 59 85db43f 56->59 69 85db56b-85db571 57->69 70 85db572-85db5f8 57->70 58->57 60 85db484-85db486 58->60 59->52 62 85db4a9-85db4ac 60->62 63 85db488-85db492 60->63 62->57 64 85db494 63->64 65 85db496-85db4a5 63->65 64->65 65->65 67 85db4a7 65->67 67->62 69->70 80 85db608-85db60c 70->80 81 85db5fa-85db5fe 70->81 83 85db61c-85db620 80->83 84 85db60e-85db612 80->84 81->80 82 85db600 81->82 82->80 85 85db630-85db634 83->85 86 85db622-85db626 83->86 84->83 87 85db614 84->87 89 85db646-85db64d 85->89 90 85db636-85db63c 85->90 86->85 88 85db628 86->88 87->83 88->85 91 85db64f-85db65e 89->91 92 85db664 89->92 90->89 91->92
                                              APIs
                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 085DB556
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CreateProcess
                                              • String ID:
                                              • API String ID: 963392458-0
                                              • Opcode ID: b9c9ab2d843b0c41ddae24c4d67cf66ec9f0eaf1851558ad5815d561b6a058af
                                              • Instruction ID: 5c5a19c0779b45e48c1253705e0605c757e847cac4eccb3af3da7fd1552f47e3
                                              • Opcode Fuzzy Hash: b9c9ab2d843b0c41ddae24c4d67cf66ec9f0eaf1851558ad5815d561b6a058af
                                              • Instruction Fuzzy Hash: 0A912A71D00319CFDF24CFA9C8817EEBBB2BB48325F1585A9D809A7240DB749985CF92
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA9750 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 94 ba9750-ba9765 call ba81a4 97 ba977b-ba977f 94->97 98 ba9767 94->98 99 ba9793-ba97d4 97->99 100 ba9781-ba978b 97->100 151 ba976d call ba99d8 98->151 152 ba976d call ba99d0 98->152 105 ba97e1-ba97ef 99->105 106 ba97d6-ba97de 99->106 100->99 101 ba9773-ba9775 101->97 104 ba98b0-ba991e 101->104 142 ba9927-ba992d 104->142 108 ba9813-ba9815 105->108 109 ba97f1-ba97f6 105->109 106->105 112 ba9818-ba981f 108->112 110 ba97f8-ba97ff call ba81b0 109->110 111 ba9801 109->111 115 ba9803-ba9811 110->115 111->115 116 ba982c-ba9833 112->116 117 ba9821-ba9829 112->117 115->112 118 ba9840-ba9849 call ba81c0 116->118 119 ba9835-ba983d 116->119 117->116 124 ba984b-ba9853 118->124 125 ba9856-ba985b 118->125 119->118 124->125 127 ba9879-ba987d 125->127 128 ba985d-ba9864 125->128 149 ba9880 call ba9ce0 127->149 150 ba9880 call ba9cd0 127->150 128->127 129 ba9866-ba9876 call ba933c call ba934c 128->129 129->127 132 ba9883-ba9886 133 ba9888-ba98a6 132->133 134 ba98a9-ba98af 132->134 133->134 142->142 143 ba992f-ba9970 142->143 144 ba9978-ba99a3 GetModuleHandleW 143->144 145 ba9972-ba9975 143->145 146 ba99ac-ba99c0 144->146 147 ba99a5-ba99ab 144->147 145->144 147->146 149->132 150->132 151->101 152->101
                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 00BA9996
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 808326ac2f74f6eb3de451ab14cc12959e0185c04e0357d5f66f767fac0b041e
                                              • Instruction ID: 30045836d59b80ef4f9feaaff545f34e7ab65adc422f084a297413ae00fdb9e9
                                              • Opcode Fuzzy Hash: 808326ac2f74f6eb3de451ab14cc12959e0185c04e0357d5f66f767fac0b041e
                                              • Instruction Fuzzy Hash: D3712470A04B058FDB24DF2AC04075ABBF1FF89340F10896ED486DBA50DB75E9058B91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAFDAC Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 153 bafdac-bafe1e 154 bafe29-bafe30 153->154 155 bafe20-bafe26 153->155 156 bafe3b-bafe73 154->156 157 bafe32-bafe38 154->157 155->154 158 bafe7b-bafeda CreateWindowExW 156->158 157->156 159 bafedc-bafee2 158->159 160 bafee3-baff1b 158->160 159->160 164 baff28 160->164 165 baff1d-baff20 160->165 166 baff29 164->166 165->164 166->166
                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00BAFECA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: 7dd37f7927c279f098723570b8d8a893bb3fb48d35b94a7b6445e5b5e3180fa1
                                              • Instruction ID: b3094b80d1090258498640b5f54dc72eb67769b65e6de68d79564ce0fa0ded8e
                                              • Opcode Fuzzy Hash: 7dd37f7927c279f098723570b8d8a893bb3fb48d35b94a7b6445e5b5e3180fa1
                                              • Instruction Fuzzy Hash: 5D51FEB1D003099FDB14CFA9D884ADDBBF6BF48314F24826AE819AB250D7749885CF80
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAFDB8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 167 bafdb8-bafe1e 168 bafe29-bafe30 167->168 169 bafe20-bafe26 167->169 170 bafe3b-bafeda CreateWindowExW 168->170 171 bafe32-bafe38 168->171 169->168 173 bafedc-bafee2 170->173 174 bafee3-baff1b 170->174 171->170 173->174 178 baff28 174->178 179 baff1d-baff20 174->179 180 baff29 178->180 179->178 180->180
                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00BAFECA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: ad20922b5478308879699ab9ad08ef5521bf2f2fece328c7a22d9a692e3707bc
                                              • Instruction ID: 1e366ff3f4dad2ad5495c7984b15ba17587a488c627f4a4a37914aa91e1956ba
                                              • Opcode Fuzzy Hash: ad20922b5478308879699ab9ad08ef5521bf2f2fece328c7a22d9a692e3707bc
                                              • Instruction Fuzzy Hash: 7641BEB1D003099FDB14CFAAD884ADEBBF5FF49314F24826AE419AB210D7759845CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA5364 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 181 ba5364-ba5431 CreateActCtxA 183 ba543a-ba5494 181->183 184 ba5433-ba5439 181->184 191 ba54a3-ba54a7 183->191 192 ba5496-ba5499 183->192 184->183 193 ba54b8 191->193 194 ba54a9-ba54b5 191->194 192->191 196 ba54b9 193->196 194->193 196->196
                                              APIs
                                              • CreateActCtxA.KERNEL32(?), ref: 00BA5421
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Create
                                              • String ID:
                                              • API String ID: 2289755597-0
                                              • Opcode ID: 639d9abe74c64b3c42346b1f805ca55238f81d3b0298144d4fa46211b92db16a
                                              • Instruction ID: d25702fd9af7ff931d8332224e9ae773701a43d4b642aa4198fab4803686bd62
                                              • Opcode Fuzzy Hash: 639d9abe74c64b3c42346b1f805ca55238f81d3b0298144d4fa46211b92db16a
                                              • Instruction Fuzzy Hash: BB41D2B1C00619CEDB24DFA9C884BCEBBF5BF59314F2081AAD408AB255DBB55985CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA3CAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 197 ba3cac-ba5431 CreateActCtxA 200 ba543a-ba5494 197->200 201 ba5433-ba5439 197->201 208 ba54a3-ba54a7 200->208 209 ba5496-ba5499 200->209 201->200 210 ba54b8 208->210 211 ba54a9-ba54b5 208->211 209->208 213 ba54b9 210->213 211->210 213->213
                                              APIs
                                              • CreateActCtxA.KERNEL32(?), ref: 00BA5421
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Create
                                              • String ID:
                                              • API String ID: 2289755597-0
                                              • Opcode ID: 5327a9b6a7ae34f53294fb4fd42570f7f44b7f53b9a7bd85baf2155f79daf4d0
                                              • Instruction ID: 66c164c4d8b419ce8471e33741e879266f4da68728ffea09e1d3687720206377
                                              • Opcode Fuzzy Hash: 5327a9b6a7ae34f53294fb4fd42570f7f44b7f53b9a7bd85baf2155f79daf4d0
                                              • Instruction Fuzzy Hash: B241D171C04618CBDB24DFAAC884BCDBBF5BF49304F2080AAD408AB255DBB56985CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BABA37 Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 214 baba37-baba40 215 baba42-babb66 214->215 216 bab9e4-baba0c DuplicateHandle 214->216 218 baba0e-baba14 216->218 219 baba15-baba32 216->219 218->219
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BAB9FF
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 7a02c3011c18ada1279d26cb0a503fd401851a88ff77d0dc1a14c8d9a70b5c82
                                              • Instruction ID: b5fcfe653f07bd07d70fb3ddbedf935e4df7ef49bde7b8fb743589f938e71783
                                              • Opcode Fuzzy Hash: 7a02c3011c18ada1279d26cb0a503fd401851a88ff77d0dc1a14c8d9a70b5c82
                                              • Instruction Fuzzy Hash: 68419834A453489FE704DF60F858BAABBE5FB99740F10802AE949DB3A1DB700841DB10
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DB008 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 233 85db008-85db056 235 85db058-85db064 233->235 236 85db066-85db0a5 WriteProcessMemory 233->236 235->236 238 85db0ae-85db0de 236->238 239 85db0a7-85db0ad 236->239 239->238
                                              APIs
                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 085DB098
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MemoryProcessWrite
                                              • String ID:
                                              • API String ID: 3559483778-0
                                              • Opcode ID: 5b876d1513b38f4b36bf47bd58dc59a510187461547f7982b5256161e157d2a6
                                              • Instruction ID: 6931764d85b7522d55f20d64f8a73264318c4eb181821187167fffc9f8c76cdc
                                              • Opcode Fuzzy Hash: 5b876d1513b38f4b36bf47bd58dc59a510187461547f7982b5256161e157d2a6
                                              • Instruction Fuzzy Hash: 762127B59003599FCF10CFAAC8847EEBBF5FF48324F50842AE918A7240D7789944CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAB973 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 243 bab973-bab9e3 244 bab9e4-baba0c DuplicateHandle 243->244 245 baba0e-baba14 244->245 246 baba15-baba32 244->246 245->246
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BAB9FF
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: fdeff0ae4f678c109cd5d048aca7a7f319773530a4af1763f8daa6799eb55835
                                              • Instruction ID: 69b05ef5621060036be5e3bee954fc75dc34982a1c4d7a90df7a6241af2eb801
                                              • Opcode Fuzzy Hash: fdeff0ae4f678c109cd5d048aca7a7f319773530a4af1763f8daa6799eb55835
                                              • Instruction Fuzzy Hash: 5721E3B5900248AFDB10CFAAD584ADEBFF8EF48324F14845AE854B3211D378A945CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DB128 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 259 85db128-85db1b5 ReadProcessMemory 262 85db1be-85db1ee 259->262 263 85db1b7-85db1bd 259->263 263->262
                                              APIs
                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 085DB1A8
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MemoryProcessRead
                                              • String ID:
                                              • API String ID: 1726664587-0
                                              • Opcode ID: 6e730edda6b7b1978d41b47c26017c690859c6f4d5464b696ba06c607b1e9354
                                              • Instruction ID: 3455467fc5992c28901c66dcf8688fc1a7174d8904801bb7cacde66235bd4e09
                                              • Opcode Fuzzy Hash: 6e730edda6b7b1978d41b47c26017c690859c6f4d5464b696ba06c607b1e9354
                                              • Instruction Fuzzy Hash: 032128B18003599FCB10DFAAC8846EEBBF5FF48324F50842AE918A7240C7789945CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DAD80 Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 249 85dad80-85dadcb 251 85dadcd-85dadd9 249->251 252 85daddb-85dae0b SetThreadContext 249->252 251->252 254 85dae0d-85dae13 252->254 255 85dae14-85dae44 252->255 254->255
                                              APIs
                                              • SetThreadContext.KERNELBASE(?,00000000), ref: 085DADFE
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: ContextThread
                                              • String ID:
                                              • API String ID: 1591575202-0
                                              • Opcode ID: 2a3f2ffbc9128bfd77fab6160867e91579c82040c07eafd321ebad2a4098ca1b
                                              • Instruction ID: a0fb9f4693263942aace6142563cc1c6bb205600e1f7a4b4b55d6267b9a2bae9
                                              • Opcode Fuzzy Hash: 2a3f2ffbc9128bfd77fab6160867e91579c82040c07eafd321ebad2a4098ca1b
                                              • Instruction Fuzzy Hash: F32104B19003198FCB10DFAAC4847EEBBF5EF48325F54842ED859A7240DB78A945CBA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAB978 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 267 bab978-bab9e3 268 bab9e4-baba0c DuplicateHandle 267->268 269 baba0e-baba14 268->269 270 baba15-baba32 268->270 269->270
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BAB9FF
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 98142e677bb4669485bf729e3ceccb39abaea65d9f0c2fee9f99ffde4d811f56
                                              • Instruction ID: a6f9b8131ca2bbdda5c42309e0b36b329bac2b65f90a18a126cc0e93cb24666e
                                              • Opcode Fuzzy Hash: 98142e677bb4669485bf729e3ceccb39abaea65d9f0c2fee9f99ffde4d811f56
                                              • Instruction Fuzzy Hash: 0621C4B59002589FDB10CF9AD584ADEBBF8EB48324F14845AE954B3310D378A944CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA9BB3 Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 273 ba9bb3-ba9bb5 274 ba9baf-ba9bb2 273->274 275 ba9bb7-ba9bf8 273->275 274->273 277 ba9bfa-ba9bfd 275->277 278 ba9c00-ba9c2f LoadLibraryExW 275->278 277->278 279 ba9c38-ba9c55 278->279 280 ba9c31-ba9c37 278->280 280->279
                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BA9A11,00000800,00000000,00000000), ref: 00BA9C22
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: c0b299559640fa23932ff7d44aeb81b2e838fd55750d3226dd5f044455ecf0ea
                                              • Instruction ID: 208825c2f7809c3459f6b0e7f71e090021c16299c3028e2071f40a2bf71a4c81
                                              • Opcode Fuzzy Hash: c0b299559640fa23932ff7d44aeb81b2e838fd55750d3226dd5f044455ecf0ea
                                              • Instruction Fuzzy Hash: 852133B6C043489FCB10CFAAD844ADEFBF4EB99320F10846ED815A7200C3B5A945CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA9368 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BA9A11,00000800,00000000,00000000), ref: 00BA9C22
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: 0f32522ae5dfc4b6a3249b188974955de20ee711a510478247ac08f2a1381ced
                                              • Instruction ID: e47cf95175a00aee2299c466520334ba4683335323d4daf473cf0d7bf28c3b12
                                              • Opcode Fuzzy Hash: 0f32522ae5dfc4b6a3249b188974955de20ee711a510478247ac08f2a1381ced
                                              • Instruction Fuzzy Hash: 801114B69046089FCB10DF9AD444ADEFBF8EB58324F14846AE415A7600D378A945CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DAF18 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 085DAF86
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: AllocVirtual
                                              • String ID:
                                              • API String ID: 4275171209-0
                                              • Opcode ID: ded31c19be5ec46762547f26453c6608c994c3d73fae7d5dd430fd7d9f3c58fe
                                              • Instruction ID: 6586397dc2305dfa0d4efeaecec7e302e3bfb6b751ffbd827f30596c529737b3
                                              • Opcode Fuzzy Hash: ded31c19be5ec46762547f26453c6608c994c3d73fae7d5dd430fd7d9f3c58fe
                                              • Instruction Fuzzy Hash: 301126B59002499FCB10DFAAC8447EFBFF5EF48324F14881AE519A7250C779A944CBA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085DACA0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: ResumeThread
                                              • String ID:
                                              • API String ID: 947044025-0
                                              • Opcode ID: af5bfe2490df8890b63e2125cd590391beff3169bc312e941e61e3023f5a315f
                                              • Instruction ID: a94e51c675394e8b0f1e4da7193db700b18b02a2a337f549c1a5d2c45807fba6
                                              • Opcode Fuzzy Hash: af5bfe2490df8890b63e2125cd590391beff3169bc312e941e61e3023f5a315f
                                              • Instruction Fuzzy Hash: 3E1128B19003598BCB10DFAAC4447EFFBF9AF88325F24845AD419A7240C778A944CBA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BA9930 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 00BA9996
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 49f0fed3d9bf82914adf8abf0ce8b8a295ece2d7c14f8e83238d9be9fc3876a1
                                              • Instruction ID: faf1f25958990fae13d306e2ba2108a03d3004137884f44a4e5bc69d585bdd61
                                              • Opcode Fuzzy Hash: 49f0fed3d9bf82914adf8abf0ce8b8a295ece2d7c14f8e83238d9be9fc3876a1
                                              • Instruction Fuzzy Hash: 9F110FB6C002498FCB10CF9AC444BDEFBF8EB89324F10845AD459B7610D379A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 08808250 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • PostMessageW.USER32(?,?,?,?), ref: 088082AD
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.374216658.0000000008800000.00000040.00000800.00020000.00000000.sdmp, Offset: 08800000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_8800000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: fe9f6d2d1ffb1514a7eb533bb183c1ccc7948847752f21ec5de9257dfd3c6db2
                                              • Instruction ID: 77ba9b13db52c1b73b3a10aca38b7987908726bd620d3587c20d9d138b358806
                                              • Opcode Fuzzy Hash: fe9f6d2d1ffb1514a7eb533bb183c1ccc7948847752f21ec5de9257dfd3c6db2
                                              • Instruction Fuzzy Hash: 411115B58003499FDB10CF9AD984BDEFBF8EB58324F10841AE554B3600C378A584CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 085D3390 Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: R
                                              • API String ID: 0-1466425173
                                              • Opcode ID: 97cacff68e0018ddd7a8bddd4fc3c71fdc12940cfb691622264733bec2b77f01
                                              • Instruction ID: 3f4035af8553c265d899ea503982b950ebb39593d9a7c47f27cd86598ceb5fd6
                                              • Opcode Fuzzy Hash: 97cacff68e0018ddd7a8bddd4fc3c71fdc12940cfb691622264733bec2b77f01
                                              • Instruction Fuzzy Hash: 0B414071E01A188FE758CF6B8D4479AFAF7BFC9301F04C1B9980CAA255EB3449858E51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085D3381 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: R
                                              • API String ID: 0-1466425173
                                              • Opcode ID: e572fc9b71af45d5a78c182d836d71bb6396afe7589a136245ea1ba03a649fdf
                                              • Instruction ID: 6db822965ca50eb8ec51c7caee677a2329afaf67fc1d6f879b58f1324758033c
                                              • Opcode Fuzzy Hash: e572fc9b71af45d5a78c182d836d71bb6396afe7589a136245ea1ba03a649fdf
                                              • Instruction Fuzzy Hash: 1F412171E01A588FEB5CCF6B8D4069AFAF3BFC8201F18C1BA884CAA255EB3005458F11
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAE638 Relevance: .3, Instructions: 315COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 772132ebac6a7dec8613a5b5cfc34a933c391c2c05035af7c8e3350fb58fe7f8
                                              • Instruction ID: 5c318d05e2f6a7bac38f8eea0757ecd2a267cc3b6f93990372d92773fb1b95d8
                                              • Opcode Fuzzy Hash: 772132ebac6a7dec8613a5b5cfc34a933c391c2c05035af7c8e3350fb58fe7f8
                                              • Instruction Fuzzy Hash: 0912B5F1413F668AE730CF65ECA8189BBA1B745329B90430BD1651F6F0EBB8118ACF44
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAC1F4 Relevance: .3, Instructions: 265COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 244a8d6e66dfde2c8a482b00f84dd39af0dcc20e3766002d70c12dbdd0a18a93
                                              • Instruction ID: 7fef50c288c64d51e6069945ec7eb49aefa7571fa174b76d0a96f93c370122d4
                                              • Opcode Fuzzy Hash: 244a8d6e66dfde2c8a482b00f84dd39af0dcc20e3766002d70c12dbdd0a18a93
                                              • Instruction Fuzzy Hash: 75A14E36E046198FCF05DFA5C8445DEBBF2FF85300B1585AAE906BB261EB71E945CB40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00BAE628 Relevance: .2, Instructions: 221COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.336404057.0000000000BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_ba0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 173d9377142e18864244b3890a3f615e14051f6a58354dd6dc165b947aceb355
                                              • Instruction ID: b10e32266fb8535a8d956b2875b9caa4fb1923167579a6b61a61b829ee70cb47
                                              • Opcode Fuzzy Hash: 173d9377142e18864244b3890a3f615e14051f6a58354dd6dc165b947aceb355
                                              • Instruction Fuzzy Hash: DFC109B1513F668AD720CF65ECA8189BBB1BB85324F51431AD1612F6F0EBB4118ACF44
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085D30E1 Relevance: .2, Instructions: 173COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 1c3f632421aa5c621fded9228deb37a4390c48254afeb846e9f48c08a58be3e2
                                              • Instruction ID: 5708c3dcb7d51baa11801d15dd695a1d4f8f0c3a939f0cac1e5fa6dd712febce
                                              • Opcode Fuzzy Hash: 1c3f632421aa5c621fded9228deb37a4390c48254afeb846e9f48c08a58be3e2
                                              • Instruction Fuzzy Hash: 9B714A71A153099FE748EFBAE84169ABFF7BB84304F14C429E4049F268EF711A458F50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 085D30F0 Relevance: .2, Instructions: 160COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.372582916.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_85d0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 85033683143aafd576ba4c9dceb88d95db104346ec17824de013a7a870170104
                                              • Instruction ID: fbf0cf2ba38b88f38dbb61aeed8bd88dad97863023b8c82dc9767df1e5780f83
                                              • Opcode Fuzzy Hash: 85033683143aafd576ba4c9dceb88d95db104346ec17824de013a7a870170104
                                              • Instruction Fuzzy Hash: D3611A71A153099FE748EFBAE84169ABFF7BB84304F14C429E4049F268EE751A458F50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 08800011 Relevance: .1, Instructions: 104COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.374216658.0000000008800000.00000040.00000800.00020000.00000000.sdmp, Offset: 08800000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_8800000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 3e144ce23c4e40893de04d15dbf8f996d7154e7b7970e499c43f5c0b3a44bc29
                                              • Instruction ID: 381c24c7298136f4acdab4bc5ff841e83c0b782e625f9f6a431063643d495e21
                                              • Opcode Fuzzy Hash: 3e144ce23c4e40893de04d15dbf8f996d7154e7b7970e499c43f5c0b3a44bc29
                                              • Instruction Fuzzy Hash: B3415E71D15A588FE75DCF6B9D5068AFBF3AFC9201F18C1BAC44CAA265DB3005868F11
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 08800040 Relevance: .1, Instructions: 98COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.374216658.0000000008800000.00000040.00000800.00020000.00000000.sdmp, Offset: 08800000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_8800000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 002388a734ba53567a45de2a75335838e13955c423e26dbbbd18d8049c5d88f1
                                              • Instruction ID: 318bf7491d90099a19405935a5dc7cb7ff652044567a96e5beb6bb05cd665d25
                                              • Opcode Fuzzy Hash: 002388a734ba53567a45de2a75335838e13955c423e26dbbbd18d8049c5d88f1
                                              • Instruction Fuzzy Hash: C2414071D05A58CBEB5CCF6B9D4069AFAF3AFC8305F14C1BAC50CAA255EB3049868F11
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Execution Graph

                                              Execution Coverage:10.2%
                                              Dynamic/Decrypted Code Coverage:100%
                                              Signature Coverage:0%
                                              Total number of Nodes:110
                                              Total number of Limit Nodes:8
                                              execution_graph 18675 2b0e190 18676 2b0e1ea 18675->18676 18677 2b0e26f GetCurrentThreadId 18676->18677 18678 2b0e29f 18676->18678 18677->18678 18679 2b0c3d0 SendMessageW 18680 2b0c444 18679->18680 18605 10c6758 18607 10c6766 18605->18607 18608 10c6344 18605->18608 18609 10c634f 18608->18609 18612 10c6394 18609->18612 18611 10c688d 18611->18607 18613 10c639f 18612->18613 18616 10c63c4 18613->18616 18615 10c6962 18615->18611 18617 10c63cf 18616->18617 18620 10c63f4 18617->18620 18619 10c6a62 18619->18615 18622 10c63ff 18620->18622 18621 10c71bc 18621->18619 18622->18621 18624 10cb406 18622->18624 18626 10cb429 18624->18626 18625 10cb44d 18625->18621 18626->18625 18629 10cb5b8 18626->18629 18633 10cb5ab 18626->18633 18630 10cb5c5 18629->18630 18631 10cb5ff 18630->18631 18637 10ca0ec 18630->18637 18631->18625 18636 10cb5c5 18633->18636 18634 10cb5ff 18634->18625 18635 10ca0ec 6 API calls 18635->18634 18636->18634 18636->18635 18638 10ca0f1 18637->18638 18640 10cc2f8 18638->18640 18641 10cb904 18638->18641 18640->18640 18642 10cb90f 18641->18642 18643 10cc367 18642->18643 18644 10c63f4 6 API calls 18642->18644 18651 10cc3e0 18643->18651 18657 10cc3d3 18643->18657 18644->18643 18645 10cc375 18647 10ce0d8 LoadLibraryExW GetModuleHandleW CreateWindowExW 18645->18647 18648 10ce0f0 LoadLibraryExW GetModuleHandleW CreateWindowExW 18645->18648 18646 10cc3a0 18646->18640 18647->18646 18648->18646 18652 10cc40e 18651->18652 18654 10cc437 18652->18654 18656 10cc4df 18652->18656 18663 10cb9a0 18652->18663 18655 10cc4da KiUserCallbackDispatcher 18654->18655 18654->18656 18655->18656 18658 10cc40e 18657->18658 18659 10cb9a0 GetFocus 18658->18659 18660 10cc437 18658->18660 18662 10cc4df 18658->18662 18659->18660 18661 10cc4da KiUserCallbackDispatcher 18660->18661 18660->18662 18661->18662 18664 10cb9ab 18663->18664 18665 10cba14 GetFocus 18664->18665 18666 10cc9f5 18664->18666 18665->18666 18666->18654 18681 2b050d4 18682 2b0d240 SendMessageW 18681->18682 18683 2b0d2ac 18682->18683 18588 2b0f5f8 18591 2b0f65d 18588->18591 18589 2b0fac0 WaitMessage 18589->18591 18590 2b0f6aa 18591->18589 18591->18590 18592 2b0e3fb 18593 2b0e40e 18592->18593 18596 2b032d8 18593->18596 18595 2b0e431 18597 2b0e6e0 PostMessageW 18596->18597 18598 2b0e74c 18597->18598 18598->18595 18599 10cfe40 SetWindowLongW 18600 10cfeac 18599->18600 18667 10cb6d0 GetCurrentProcess 18668 10cb74a GetCurrentThread 18667->18668 18669 10cb743 18667->18669 18670 10cb787 GetCurrentProcess 18668->18670 18671 10cb780 18668->18671 18669->18668 18672 10cb7bd 18670->18672 18671->18670 18673 10cb7e5 GetCurrentThreadId 18672->18673 18674 10cb816 18673->18674 18684 2b04f1c 18686 2b04f27 18684->18686 18685 2b0f091 18686->18685 18688 2b0dc44 18686->18688 18689 2b0dc4f 18688->18689 18690 2b0f3ab 18689->18690 18692 2b0dc60 18689->18692 18690->18685 18693 2b0f3e0 OleInitialize 18692->18693 18694 2b0f444 18693->18694 18694->18690 18695 10c92f0 18696 10c92ff 18695->18696 18698 10c93e8 18695->18698 18699 10c93fb 18698->18699 18701 10c9413 18699->18701 18706 10c9660 18699->18706 18710 10c9670 18699->18710 18700 10c940b 18700->18701 18702 10c9610 GetModuleHandleW 18700->18702 18701->18696 18703 10c963d 18702->18703 18703->18696 18707 10c9684 18706->18707 18709 10c96a9 18707->18709 18714 10c8768 18707->18714 18709->18700 18711 10c9684 18710->18711 18712 10c8768 LoadLibraryExW 18711->18712 18713 10c96a9 18711->18713 18712->18713 18713->18700 18715 10c9850 LoadLibraryExW 18714->18715 18717 10c98c9 18715->18717 18717->18709 18601 10cbdc1 18602 10cbd62 DuplicateHandle 18601->18602 18604 10cbdcf 18601->18604 18603 10cbd96 18602->18603

                                              Executed Functions

                                              Function 02B0F5F8 Relevance: 1.9, APIs: 1, Instructions: 396COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 38 2b0f5f8-2b0f65b 39 2b0f68a-2b0f6a8 38->39 40 2b0f65d-2b0f687 38->40 45 2b0f6b1-2b0f6e8 39->45 46 2b0f6aa-2b0f6ac 39->46 40->39 50 2b0fb19 45->50 51 2b0f6ee-2b0f702 45->51 48 2b0fb6a-2b0fb7f 46->48 54 2b0fb1e-2b0fb34 50->54 52 2b0f731-2b0f750 51->52 53 2b0f704-2b0f72e 51->53 60 2b0f752-2b0f758 52->60 61 2b0f768-2b0f76a 52->61 53->52 54->48 65 2b0f75a 60->65 66 2b0f75c-2b0f75e 60->66 62 2b0f789-2b0f792 61->62 63 2b0f76c-2b0f784 61->63 67 2b0f79a-2b0f7a1 62->67 63->54 65->61 66->61 68 2b0f7a3-2b0f7a9 67->68 69 2b0f7ab-2b0f7b2 67->69 70 2b0f7bf-2b0f7dc call 2b0dcc0 68->70 71 2b0f7b4-2b0f7ba 69->71 72 2b0f7bc 69->72 75 2b0f931-2b0f935 70->75 76 2b0f7e2-2b0f7e9 70->76 71->70 72->70 77 2b0fb04-2b0fb17 75->77 78 2b0f93b-2b0f93f 75->78 76->50 79 2b0f7ef-2b0f82c 76->79 77->54 80 2b0f941-2b0f954 78->80 81 2b0f959-2b0f962 78->81 85 2b0f832-2b0f837 79->85 86 2b0fafa-2b0fafe 79->86 80->54 83 2b0f991-2b0f998 81->83 84 2b0f964-2b0f98e 81->84 87 2b0fa37-2b0fa4c 83->87 88 2b0f99e-2b0f9a5 83->88 84->83 91 2b0f869-2b0f87e call 2b0dce4 85->91 92 2b0f839-2b0f847 call 2b0dccc 85->92 86->67 86->77 87->86 102 2b0fa52-2b0fa54 87->102 89 2b0f9d4-2b0f9f6 88->89 90 2b0f9a7-2b0f9d1 88->90 89->87 128 2b0f9f8-2b0fa02 89->128 90->89 100 2b0f883-2b0f887 91->100 92->91 103 2b0f849-2b0f867 call 2b0dcd8 92->103 104 2b0f8f8-2b0f905 100->104 105 2b0f889-2b0f89b call 2b0dcf0 100->105 106 2b0faa1-2b0fabe call 2b0dcc0 102->106 107 2b0fa56-2b0fa8f 102->107 103->100 104->86 122 2b0f90b-2b0f915 call 2b0dd00 104->122 130 2b0f8db-2b0f8f3 105->130 131 2b0f89d-2b0f8cd 105->131 106->86 121 2b0fac0-2b0faec WaitMessage 106->121 118 2b0fa91-2b0fa97 107->118 119 2b0fa98-2b0fa9f 107->119 118->119 119->86 125 2b0faf3 121->125 126 2b0faee 121->126 135 2b0f924-2b0f92c call 2b0dd18 122->135 136 2b0f917-2b0f91a call 2b0dd0c 122->136 125->86 126->125 137 2b0fa04-2b0fa0a 128->137 138 2b0fa1a-2b0fa35 128->138 130->54 145 2b0f8d4 131->145 146 2b0f8cf 131->146 135->86 147 2b0f91f 136->147 142 2b0fa0c 137->142 143 2b0fa0e-2b0fa10 137->143 138->87 138->128 142->138 143->138 145->130 146->145 147->86
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 836c442a185462f2978a85c7b70152c632b90ed97998cae1ad6f624286858aec
                                              • Instruction ID: 327d7f0adcf402f8c40689cc1822f99ea8fea05fba40041efa7f530ad8d4a40c
                                              • Opcode Fuzzy Hash: 836c442a185462f2978a85c7b70152c632b90ed97998cae1ad6f624286858aec
                                              • Instruction Fuzzy Hash: A1F14B30B00209CFDB25DFA9C994BADBBF1FF88304F158199E419AB6A1DB74A945CF40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CB6C0 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 010CB730
                                              • GetCurrentThread.KERNEL32 ref: 010CB76D
                                              • GetCurrentProcess.KERNEL32 ref: 010CB7AA
                                              • GetCurrentThreadId.KERNEL32 ref: 010CB803
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: a202f149f692b681651aedf50811508c3efa64f5a116c9d95b4c26756714414b
                                              • Instruction ID: afd59f24cf4a078185f356bd64dca627894c02d9c7be6dac445e75a0943c12d6
                                              • Opcode Fuzzy Hash: a202f149f692b681651aedf50811508c3efa64f5a116c9d95b4c26756714414b
                                              • Instruction Fuzzy Hash: 265177B4D002488FDB14CFAAD6887EEBFF1BF48314F24859AE489A7290C7745885CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CB6D0 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 010CB730
                                              • GetCurrentThread.KERNEL32 ref: 010CB76D
                                              • GetCurrentProcess.KERNEL32 ref: 010CB7AA
                                              • GetCurrentThreadId.KERNEL32 ref: 010CB803
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 3ca570a8f085e1117c5db3adbed5af9175efd37e4d4005d685493c4a8e48b77e
                                              • Instruction ID: 4306408550553044f664e804efc5694e073488d8062230e70e9ba3856df725dc
                                              • Opcode Fuzzy Hash: 3ca570a8f085e1117c5db3adbed5af9175efd37e4d4005d685493c4a8e48b77e
                                              • Instruction Fuzzy Hash: 525144B4D006488FDB14CFAAD688B9EBFF5BF48314F248559E489A3390D7785844CF65
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CFAA0 Relevance: 1.7, APIs: 1, Instructions: 246COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 150 10cfaa0-10cfb88 151 10cfbec-10cfc5e 150->151 152 10cfb8a-10cfbd8 call 10cda04 150->152 154 10cfc69-10cfc70 151->154 155 10cfc60-10cfc66 151->155 156 10cfbdd-10cfbde 152->156 157 10cfc7b-10cfd1a CreateWindowExW 154->157 158 10cfc72-10cfc78 154->158 155->154 160 10cfd1c-10cfd22 157->160 161 10cfd23-10cfd5b 157->161 158->157 160->161 165 10cfd5d-10cfd60 161->165 166 10cfd68 161->166 165->166 167 10cfd69 166->167 167->167
                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010CFD0A
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: 320d8e65b88260f7af7f5054303e7081807f8de90cabd6750034e6383a597b34
                                              • Instruction ID: 9f4053f66725ec3e4e0f144fb8d5b98d873a57aa5d761144bcc4c374997149e6
                                              • Opcode Fuzzy Hash: 320d8e65b88260f7af7f5054303e7081807f8de90cabd6750034e6383a597b34
                                              • Instruction Fuzzy Hash: AB917D718083899FDF12CFA4C8959DDBFB1EF0A314F1980AAE884AB263C774545ADF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B0E190 Relevance: 1.7, APIs: 1, Instructions: 217threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 168 2b0e190-2b0e1f4 171 2b0e482-2b0e53d 168->171 172 2b0e1fa-2b0e212 call 2b0324c call 2b03d48 168->172 195 2b0e543-2b0e54e 171->195 179 2b0e214-2b0e21a 172->179 180 2b0e22a-2b0e22c 172->180 181 2b0e21c 179->181 182 2b0e21e-2b0e220 179->182 184 2b0e23c-2b0e29d call 2b02750 GetCurrentThreadId 180->184 185 2b0e22e-2b0e235 call 2b03d70 180->185 181->180 182->180 196 2b0e2a6-2b0e2af 184->196 197 2b0e29f-2b0e2a5 184->197 185->184 198 2b0e550-2b0e556 195->198 199 2b0e557-2b0e56b 195->199 200 2b0e2c0-2b0e2c6 196->200 201 2b0e2b1-2b0e2b7 196->201 197->196 198->199 202 2b0e2c8-2b0e2cd 200->202 203 2b0e2cf 200->203 201->200 205 2b0e2b9 201->205 202->203 208 2b0e2d9-2b0e315 203->208 205->200 211 2b0e335-2b0e350 208->211 212 2b0e317-2b0e32d 208->212 214 2b0e352 211->214 215 2b0e35a 211->215 212->211 214->215 215->171
                                              APIs
                                              • GetCurrentThreadId.KERNEL32 ref: 02B0E289
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CurrentThread
                                              • String ID:
                                              • API String ID: 2882836952-0
                                              • Opcode ID: 29cdd469b93906ca2e72ec7832caf96345583e7d5fa79853486745c248d139fc
                                              • Instruction ID: 30fc2d31455c3dd79234e862d93ae81b86c7a89df81f7d846fc12e4e8c341da3
                                              • Opcode Fuzzy Hash: 29cdd469b93906ca2e72ec7832caf96345583e7d5fa79853486745c248d139fc
                                              • Instruction Fuzzy Hash: 1D818C70E002588FCB15DFA9C494AAEBFF5FF48314F1484AAD455AB390DB749945CFA0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010C93E8 Relevance: 1.7, APIs: 1, Instructions: 194COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 218 10c93e8-10c93fd call 10c8704 221 10c93ff 218->221 222 10c9413-10c9417 218->222 273 10c9405 call 10c9660 221->273 274 10c9405 call 10c9670 221->274 223 10c9419-10c9423 222->223 224 10c942b-10c946c 222->224 223->224 229 10c946e-10c9476 224->229 230 10c9479-10c9487 224->230 225 10c940b-10c940d 225->222 226 10c9548-10c9608 225->226 266 10c960a-10c960d 226->266 267 10c9610-10c963b GetModuleHandleW 226->267 229->230 232 10c9489-10c948e 230->232 233 10c94ab-10c94ad 230->233 235 10c9499 232->235 236 10c9490-10c9497 call 10c8710 232->236 234 10c94b0-10c94b7 233->234 238 10c94b9-10c94c1 234->238 239 10c94c4-10c94cb 234->239 237 10c949b-10c94a9 235->237 236->237 237->234 238->239 242 10c94cd-10c94d5 239->242 243 10c94d8-10c94e1 call 10c8720 239->243 242->243 248 10c94ee-10c94f3 243->248 249 10c94e3-10c94eb 243->249 251 10c94f5-10c94fc 248->251 252 10c9511-10c9515 248->252 249->248 251->252 254 10c94fe-10c950e call 10c8730 call 10c8740 251->254 271 10c9518 call 10c9968 252->271 272 10c9518 call 10c9940 252->272 254->252 255 10c951b-10c951e 258 10c9520-10c953e 255->258 259 10c9541-10c9547 255->259 258->259 266->267 268 10c963d-10c9643 267->268 269 10c9644-10c9658 267->269 268->269 271->255 272->255 273->225 274->225
                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 010C962E
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: d622c78ce61f2aa3ef38f52ff8c6487a31c4b06ca4c3c635ac7dc26ba4506a75
                                              • Instruction ID: 6fdd05634b0b5628a6264605f540c00f6959c7a5cb4830d08f8d6f033a3ed0a1
                                              • Opcode Fuzzy Hash: d622c78ce61f2aa3ef38f52ff8c6487a31c4b06ca4c3c635ac7dc26ba4506a75
                                              • Instruction Fuzzy Hash: D87136B0A00B058FD764DF2AD44079ABBF1BF88718F008A6ED48AD7A50DB74E945CF91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B0E179 Relevance: 1.6, APIs: 1, Instructions: 146threadCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 275 2b0e179-2b0e1f4 279 2b0e482-2b0e4b8 275->279 280 2b0e1fa-2b0e212 call 2b0324c call 2b03d48 275->280 301 2b0e4c0-2b0e53d 279->301 287 2b0e214-2b0e21a 280->287 288 2b0e22a-2b0e22c 280->288 289 2b0e21c 287->289 290 2b0e21e-2b0e220 287->290 292 2b0e23c-2b0e29d call 2b02750 GetCurrentThreadId 288->292 293 2b0e22e-2b0e235 call 2b03d70 288->293 289->288 290->288 304 2b0e2a6-2b0e2af 292->304 305 2b0e29f-2b0e2a5 292->305 293->292 303 2b0e543-2b0e54e 301->303 306 2b0e550-2b0e556 303->306 307 2b0e557-2b0e56b 303->307 308 2b0e2c0-2b0e2c6 304->308 309 2b0e2b1-2b0e2b7 304->309 305->304 306->307 310 2b0e2c8-2b0e2cd 308->310 311 2b0e2cf 308->311 309->308 313 2b0e2b9 309->313 310->311 316 2b0e2d9-2b0e315 311->316 313->308 319 2b0e335-2b0e350 316->319 320 2b0e317-2b0e32d 316->320 322 2b0e352 319->322 323 2b0e35a 319->323 320->319 322->323 323->279
                                              APIs
                                              • GetCurrentThreadId.KERNEL32 ref: 02B0E289
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CurrentThread
                                              • String ID:
                                              • API String ID: 2882836952-0
                                              • Opcode ID: 511edb89b56dc4bea0ce8a90065f71fe0e0b89a91cfb0f9e4bd243f8c02148eb
                                              • Instruction ID: 6ce41051efa6139964795c39e03d2d684cfa2eb567d40b4d0e4c97be02d9978a
                                              • Opcode Fuzzy Hash: 511edb89b56dc4bea0ce8a90065f71fe0e0b89a91cfb0f9e4bd243f8c02148eb
                                              • Instruction Fuzzy Hash: 08518C70D002599FDF16DFA4C894ADEBFB6FF48300F1485AAE455AB290DB749806CF60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CFBF8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 326 10cfbf8-10cfc5e 327 10cfc69-10cfc70 326->327 328 10cfc60-10cfc66 326->328 329 10cfc7b-10cfcb3 327->329 330 10cfc72-10cfc78 327->330 328->327 331 10cfcbb-10cfd1a CreateWindowExW 329->331 330->329 332 10cfd1c-10cfd22 331->332 333 10cfd23-10cfd5b 331->333 332->333 337 10cfd5d-10cfd60 333->337 338 10cfd68 333->338 337->338 339 10cfd69 338->339 339->339
                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010CFD0A
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: a4da9e4b0531727520c33fa69f4ecf5f680070df9e9617a58c621f57f5ffd21d
                                              • Instruction ID: 7601587da0cbc0ebe04ccc40d0a0de841b678d8e3efdc6c40c103f31e3ffca04
                                              • Opcode Fuzzy Hash: a4da9e4b0531727520c33fa69f4ecf5f680070df9e9617a58c621f57f5ffd21d
                                              • Instruction Fuzzy Hash: 0941C1B1D003099FDF14DFAAD984ADEBFB6BF48710F24812AE819AB210D7749945CF91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CBDC1 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 340 10cbdc1-10cbdcd 341 10cbdcf-10cbddb 340->341 342 10cbd62-10cbd94 DuplicateHandle 340->342 345 10cbde6-10cbeee 341->345 343 10cbd9d-10cbdba 342->343 344 10cbd96-10cbd9c 342->344 344->343
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010CBD87
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: ae7a03e1bfd53c90f9e0bb898867d735ac7629616e8e64c9b14520104becc295
                                              • Instruction ID: a64bc8bd7c34b50535cdaf3259307778694bac49cbadd700d238d74f9e35ed3b
                                              • Opcode Fuzzy Hash: ae7a03e1bfd53c90f9e0bb898867d735ac7629616e8e64c9b14520104becc295
                                              • Instruction Fuzzy Hash: 6E415B74A40345EFE7019FB4E945BAA7FF5EB88305F10462AEA058B7D6DB788901CF60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B0E6B0 Relevance: 1.6, APIs: 1, Instructions: 64windowCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 358 2b0e6b0-2b0e74a PostMessageW 360 2b0e753-2b0e774 358->360 361 2b0e74c-2b0e752 358->361 361->360
                                              APIs
                                              • PostMessageW.USER32(?,00DD53E8,00000000,?), ref: 02B0E73D
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: 64372c860ab459fefd1de6fec757d1c190b594c41c7fe39477befcb9f68e6923
                                              • Instruction ID: 7a2559b3930c6011d781a85c6b1a3a716b1eee6ea00252dcf87f17079a3b2f61
                                              • Opcode Fuzzy Hash: 64372c860ab459fefd1de6fec757d1c190b594c41c7fe39477befcb9f68e6923
                                              • Instruction Fuzzy Hash: 9E218EB19043498FDB11CF99C984BEEBFF4EF08324F14849AE854A7242D378A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CBCF9 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 363 10cbcf9-10cbd60 364 10cbd62-10cbd94 DuplicateHandle 363->364 365 10cbd9d-10cbdba 364->365 366 10cbd96-10cbd9c 364->366 366->365
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010CBD87
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 8d08798c2a1f12e273c54bb045fca9f1027ab014896262265207941fd85518c2
                                              • Instruction ID: 8cf599f89f6b4753c67aebe91f4176606c5a0c2e49a08ff5c96512791b958a75
                                              • Opcode Fuzzy Hash: 8d08798c2a1f12e273c54bb045fca9f1027ab014896262265207941fd85518c2
                                              • Instruction Fuzzy Hash: B32103B5D002489FDB10CFAAD584AEEBFF4EF48324F14805AE858A3210D378A944CFA0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CBD00 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 369 10cbd00-10cbd60 370 10cbd62-10cbd94 DuplicateHandle 369->370 371 10cbd9d-10cbdba 370->371 372 10cbd96-10cbd9c 370->372 372->371
                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010CBD87
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 6b1424e9edf478de92a9be18e3860b0f33a2569493285e4d5c2c09dee8e11663
                                              • Instruction ID: 83301cb412b0c464ad2a689cf334905f9f88686528169ae27e782aa3a7bc052d
                                              • Opcode Fuzzy Hash: 6b1424e9edf478de92a9be18e3860b0f33a2569493285e4d5c2c09dee8e11663
                                              • Instruction Fuzzy Hash: E621D5B5D002189FDB10CFAAD584ADEBFF9FB48324F14845AE958A3350D378A944CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010C9849 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 375 10c9849-10c9890 376 10c9898-10c98c7 LoadLibraryExW 375->376 377 10c9892-10c9895 375->377 378 10c98c9-10c98cf 376->378 379 10c98d0-10c98ed 376->379 377->376 378->379
                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010C96A9,00000800,00000000,00000000), ref: 010C98BA
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: 496d6685e345d5545eed58500795efcb0c65208ca5c84eeebcad3bc3087cbada
                                              • Instruction ID: 0986f6b994b0639491f1ee425ab8f3cd7ee314d9e18a14ed5275fb6b2b8965ac
                                              • Opcode Fuzzy Hash: 496d6685e345d5545eed58500795efcb0c65208ca5c84eeebcad3bc3087cbada
                                              • Instruction Fuzzy Hash: 602106B6C002498FDB10CFAAD444AEEFFF5EB98724F14846ED455A7600C375A549CFA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010C8768 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 382 10c8768-10c9890 384 10c9898-10c98c7 LoadLibraryExW 382->384 385 10c9892-10c9895 382->385 386 10c98c9-10c98cf 384->386 387 10c98d0-10c98ed 384->387 385->384 386->387
                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010C96A9,00000800,00000000,00000000), ref: 010C98BA
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: 174d477947613e3841744c15d629e6affa98660a13db75e10465775455d879f6
                                              • Instruction ID: f533f7e2567a300a0c1377d8a5fcf1fe12a398e78a204c95d1051eed97c55d8a
                                              • Opcode Fuzzy Hash: 174d477947613e3841744c15d629e6affa98660a13db75e10465775455d879f6
                                              • Instruction Fuzzy Hash: 771103B6D00209CFDB10CF9AC444ADFBBF8EB48724F14846EE559A7600C374A949CFA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B032D8 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 390 2b032d8-2b0e74a PostMessageW 392 2b0e753-2b0e774 390->392 393 2b0e74c-2b0e752 390->393 393->392
                                              APIs
                                              • PostMessageW.USER32(?,00DD53E8,00000000,?), ref: 02B0E73D
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: d4c7da2ba3ee3fa1948d661f8a8eec356c3f07d7fad8e66aae5c55cccd7f39fd
                                              • Instruction ID: 391499f75b6c1e6f8d5a69a6715550f283fe8b3aa17858ca3e81d5606f65fb28
                                              • Opcode Fuzzy Hash: d4c7da2ba3ee3fa1948d661f8a8eec356c3f07d7fad8e66aae5c55cccd7f39fd
                                              • Instruction Fuzzy Hash: 3E1128B59003099FDB10CF9AC585BEEBFF8FB48324F10845AE554A3641D378A984CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B0C3D0 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,02B0226A,?,00000000,?), ref: 02B0C435
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessageSend
                                              • String ID:
                                              • API String ID: 3850602802-0
                                              • Opcode ID: ea0375c75ca954c2b1b5f839911506e42b6b711d1f1e426b8e700d4beba81f5d
                                              • Instruction ID: c0ce98d9c1d64fc41c798aab819db8c30633a2ad7e566e8f222b969e2764c33c
                                              • Opcode Fuzzy Hash: ea0375c75ca954c2b1b5f839911506e42b6b711d1f1e426b8e700d4beba81f5d
                                              • Instruction Fuzzy Hash: E41125B58002489FCB20CFA9C585BEEBFF4FB48324F14855AD455A7600C374A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B050D4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • SendMessageW.USER32(?,00000018,00000001,?), ref: 02B0D29D
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessageSend
                                              • String ID:
                                              • API String ID: 3850602802-0
                                              • Opcode ID: 73590b8ac8c8c6a9908f7099d69b13e8d95264920b943d2522ed26c7acc302ed
                                              • Instruction ID: 14c811b02b9a5880df983ab6b619ca2b97e05d001834ef4ccf9e6f8d94e252ba
                                              • Opcode Fuzzy Hash: 73590b8ac8c8c6a9908f7099d69b13e8d95264920b943d2522ed26c7acc302ed
                                              • Instruction Fuzzy Hash: 0B11F2B59003099FDB10DF9AD584BDEBFF8EB58324F10845AE959A7640C374A984CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B01540 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • SendMessageW.USER32(00000000,0000020A,?,00000000,?,?,?,?,02B0226A,?,00000000,?), ref: 02B0C435
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: MessageSend
                                              • String ID:
                                              • API String ID: 3850602802-0
                                              • Opcode ID: 7b0eb8db322c1b64d1c8283adceeeaf5836651eb8c2bd5304bf2fd9652d6cdf6
                                              • Instruction ID: fce973e47cb087ebf39e35b477ed4d22d76f05bfca1748063bdd59bdfde1ef84
                                              • Opcode Fuzzy Hash: 7b0eb8db322c1b64d1c8283adceeeaf5836651eb8c2bd5304bf2fd9652d6cdf6
                                              • Instruction Fuzzy Hash: 6411F2B58007489FCB10CF9AD984BEEBFF8FB58324F14855AE559A7640C374A944CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010C95C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 010C962E
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: abf383d67f44f09c14235937b6ca54c93094630c7bf45edf1bd0fab429647c89
                                              • Instruction ID: 97b2cd73f0d12edc47769c5f68f01d5b6c7919e21a6b704f44b7b8b29afbbcc3
                                              • Opcode Fuzzy Hash: abf383d67f44f09c14235937b6ca54c93094630c7bf45edf1bd0fab429647c89
                                              • Instruction Fuzzy Hash: FA1110B6C006098FDB10CF9AC444BDEFBF8EF88328F10845AD459A7640C378A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 02B0DC60 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                              Download Yara Rule
                                              APIs
                                              • OleInitialize.OLE32(00000000), ref: 02B0F435
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.583187772.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_2b00000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: Initialize
                                              • String ID:
                                              • API String ID: 2538663250-0
                                              • Opcode ID: a2886d7836ce4deb38624f9b84f0274d8458807a75839cdf0b402b9daee67c9c
                                              • Instruction ID: 270dcbcaa732ee3d6e5165cf1fa5ed3c1cbf0e59d65f0fee27cf5cf99ed93339
                                              • Opcode Fuzzy Hash: a2886d7836ce4deb38624f9b84f0274d8458807a75839cdf0b402b9daee67c9c
                                              • Instruction Fuzzy Hash: CE1133B19003088FCB20CFAAC584BDEBFF8EB48324F14849AD459A3640C778A944CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CFE38 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                              Download Yara Rule
                                              APIs
                                              • SetWindowLongW.USER32(?,?,?), ref: 010CFE9D
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LongWindow
                                              • String ID:
                                              • API String ID: 1378638983-0
                                              • Opcode ID: 0ea64d9e316116de1c133c821a4a74f7616909b6d59e5359f577f6b1d0cee3fa
                                              • Instruction ID: 123853a34f63ce767183abd359d98c2510298108b7fcead33072278f2233742f
                                              • Opcode Fuzzy Hash: 0ea64d9e316116de1c133c821a4a74f7616909b6d59e5359f577f6b1d0cee3fa
                                              • Instruction Fuzzy Hash: 371133B58002498FDB20CFAAD584BDEBFF8EB48324F20845AD858A3741C374A944CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 010CFE40 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                              Download Yara Rule
                                              APIs
                                              • SetWindowLongW.USER32(?,?,?), ref: 010CFE9D
                                              Memory Dump Source
                                              • Source File: 00000001.00000002.582089829.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_1_2_10c0000_8249boAXzf.jbxd
                                              Similarity
                                              • API ID: LongWindow
                                              • String ID:
                                              • API String ID: 1378638983-0
                                              • Opcode ID: ef04a6372e3acf8c013f0b1d56cf5825daeae85beecaed82d7c2d68703c570ec
                                              • Instruction ID: 6569b18886dbdd5da70d9f84c1e53f26c005970ef1f784858e74146f6c56fea7
                                              • Opcode Fuzzy Hash: ef04a6372e3acf8c013f0b1d56cf5825daeae85beecaed82d7c2d68703c570ec
                                              • Instruction Fuzzy Hash: 1D1112B58002098FDB10CF9AD584BDFBBF8EB48724F20845AE959A3740C378A944CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%