Edit tour

Windows Analysis Report
IntelCpHeciSvc.exe

Overview

General Information

Sample Name:	IntelCpHeciSvc.exe
Analysis ID:	877850
MD5:	6b4a5a412e90721fba5170a25caefbd4
SHA1:	7796314ed7b9b9472b98d6efbb93164e44877c34
SHA256:	62271e4b8eeb27837dda10e85fb4b4a8f0c54b319ea06d28ffd56fab022d6f18
Tags:	exe
Infos:

Detection

Nanocore, Neshta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Neshta

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Yara detected Nanocore RAT

Infects executable files (exe, dll, sys, html)

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Machine Learning detection for sample

.NET source code contains potential unpacker

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Uses dynamic DNS services

Uses 32bit PE files

Yara signature match

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

IntelCpHeciSvc.exe (PID: 5760 cmdline: C:\Users\user\Desktop\IntelCpHeciSvc.exe MD5: 6B4A5A412E90721FBA5170A25CAEFBD4)

IntelCpHeciSvc.exe (PID: 6824 cmdline: "C:\Users\user~1\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe" MD5: 7F00E9819E4B205654B46E0090E6763E)

svchost.com (PID: 7040 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~1\DHCPMO~1\dhcpmon.exe" MD5: 36FD5E09C417C767A952B4609D73A54B)

dhcpmon.exe (PID: 4728 cmdline: C:\PROGRA~1\DHCPMO~1\dhcpmon.exe MD5: 7F00E9819E4B205654B46E0090E6763E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nanocore RAT, NanoCore	Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.	APT33 The Gorgon Group	https://assets.virustotal.com/reports/2021trends.pdf https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.morphisec.com/syk-crypter-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "7d265ee0-5eff-4ffb-9f35-947e4a7e", "Group": "Default", "Domain1": "", "Domain2": "googleusercontent.ddns.net", "Port": 54984, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
IntelCpHeciSvc.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
IntelCpHeciSvc.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
IntelCpHeciSvc.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
IntelCpHeciSvc.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
IntelCpHeciSvc.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
IntelCpHeciSvc.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
IntelCpHeciSvc.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
IntelCpHeciSvc.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
IntelCpHeciSvc.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
IntelCpHeciSvc.exe	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
Click to see the 5 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
C:\Program Files\DHCP Monitor\dhcpmon.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
C:\Program Files\DHCP Monitor\dhcpmon.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
C:\Program Files\DHCP Monitor\dhcpmon.exe	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
C:\Program Files\DHCP Monitor\dhcpmon.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
C:\Program Files\DHCP Monitor\dhcpmon.exe	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Info.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Au3Info.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Au3Info.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Info.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth (Nextron Systems)	0x192c9:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x195e1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x198c5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19bbd:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19eb5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a1c1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a4b5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a7b5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1aabd:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1adad:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1b09d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1b38d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1b699:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1b9ad:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1bcb1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1bfb5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1c2ad:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1c5c1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1c8b9:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1cba1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1ceb5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Uninstall.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Uninstall.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Uninstall.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Uninstall.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth (Nextron Systems)	0x43f85:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Au3Check.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Windows\svchost.com	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Windows\svchost.com	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Windows\svchost.com	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Windows\svchost.com	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth (Nextron Systems)	0x31181:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth (Nextron Systems)	0x5db85:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
Click to see the 455 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.403891013.00000000134B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.403891013.00000000134B0000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x42d85:$a: NanoCore 0x42dde:$a: NanoCore 0x42e1b:$a: NanoCore 0x42e94:$a: NanoCore 0x5653f:$a: NanoCore 0x56554:$a: NanoCore 0x56589:$a: NanoCore 0x6f013:$a: NanoCore 0x6f028:$a: NanoCore 0x6f05d:$a: NanoCore 0x42de7:$b: ClientPlugin 0x42e24:$b: ClientPlugin 0x43722:$b: ClientPlugin 0x4372f:$b: ClientPlugin 0x562fb:$b: ClientPlugin 0x56316:$b: ClientPlugin 0x56346:$b: ClientPlugin 0x5655d:$b: ClientPlugin 0x56592:$b: ClientPlugin 0x6edcf:$b: ClientPlugin 0x6edea:$b: ClientPlugin
00000003.00000002.403891013.00000000134B0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x42e1b:$a1: NanoCore.ClientPluginHost 0x56589:$a1: NanoCore.ClientPluginHost 0x6f05d:$a1: NanoCore.ClientPluginHost 0x42dde:$a2: NanoCore.ClientPlugin 0x56554:$a2: NanoCore.ClientPlugin 0x6f028:$a2: NanoCore.ClientPlugin 0x431b2:$b1: get_BuilderSettings 0x5b4cf:$b1: get_BuilderSettings 0x73fa3:$b1: get_BuilderSettings 0x42e69:$b4: IClientAppHost 0x43223:$b6: AddHostEntry 0x43292:$b7: LogClientException 0x5b43e:$b7: LogClientException 0x73f12:$b7: LogClientException 0x43207:$b8: PipeExists 0x42e56:$b9: IClientLoggingHost 0x565a3:$b9: IClientLoggingHost 0x6f077:$b9: IClientLoggingHost
00000002.00000002.580407779.0000000000409000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x22b1:$x1: NanoCore.ClientPluginHost 0x22ee:$x2: IClientNetworkHost 0x5e21:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2019:$a: NanoCore 0x2029:$a: NanoCore 0x225d:$a: NanoCore 0x2271:$a: NanoCore 0x22b1:$a: NanoCore 0x2078:$b: ClientPlugin 0x227a:$b: ClientPlugin 0x22ba:$b: ClientPlugin 0x219f:$c: ProjectData 0x2ba6:$d: DESCrypto 0xa572:$e: KeepAlive 0x8560:$g: LogClientMessage 0x475b:$i: get_Connected 0x2edc:$j: #=q 0x2f0c:$j: #=q 0x2f28:$j: #=q 0x2f58:$j: #=q 0x2f74:$j: #=q 0x2f90:$j: #=q 0x2fc0:$j: #=q 0x2fdc:$j: #=q
00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x22b1:$a1: NanoCore.ClientPluginHost 0x2271:$a2: NanoCore.ClientPlugin 0x41ca:$b1: get_BuilderSettings 0x20cd:$b2: ClientLoaderForm.resources 0x38ea:$b3: PluginCommand 0x22a2:$b4: IClientAppHost 0xc722:$b5: GetBlockHash 0x4822:$b6: AddHostEntry 0x8515:$b7: LogClientException 0x478f:$b8: PipeExists 0x22db:$b9: IClientLoggingHost
00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
00000000.00000002.609863549.0000000000409000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xff8d:$a1: NanoCore.ClientPluginHost 0xff4d:$a2: NanoCore.ClientPlugin 0x11ea6:$b1: get_BuilderSettings 0xfda9:$b2: ClientLoaderForm.resources 0x115c6:$b3: PluginCommand 0xff7e:$b4: IClientAppHost 0x1a3fe:$b5: GetBlockHash 0x124fe:$b6: AddHostEntry 0x161f1:$b7: LogClientException 0x1246b:$b8: PipeExists 0xffb7:$b9: IClientLoggingHost
00000003.00000002.403372406.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000003.00000002.403372406.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x2c7af:$a: NanoCore 0x2c808:$a: NanoCore 0x2c845:$a: NanoCore 0x2c8be:$a: NanoCore 0x2c811:$b: ClientPlugin 0x2c84e:$b: ClientPlugin 0x2d14c:$b: ClientPlugin 0x2d159:$b: ClientPlugin 0x23c44:$e: KeepAlive 0x2cc99:$g: LogClientMessage 0x2cc19:$i: get_Connected 0x1e425:$j: #=q 0x1e455:$j: #=q 0x1e491:$j: #=q 0x1e4b9:$j: #=q 0x1e4e9:$j: #=q 0x1e519:$j: #=q 0x1e549:$j: #=q 0x1e579:$j: #=q 0x1e595:$j: #=q 0x1e5c5:$j: #=q
00000003.00000002.403372406.00000000034A1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x2c845:$a1: NanoCore.ClientPluginHost 0x2c808:$a2: NanoCore.ClientPlugin 0x1f95f:$b1: get_BuilderSettings 0x2cbdc:$b1: get_BuilderSettings 0x2c893:$b4: IClientAppHost 0x2cc4d:$b6: AddHostEntry 0x1f8ce:$b7: LogClientException 0x2ccbc:$b7: LogClientException 0x2cc31:$b8: PipeExists 0x2c880:$b9: IClientLoggingHost
00000001.00000002.619633331.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x16d3d:$a1: NanoCore.ClientPluginHost 0x16d00:$a2: NanoCore.ClientPlugin 0x170d4:$b1: get_BuilderSettings 0x16d8b:$b4: IClientAppHost 0x17145:$b6: AddHostEntry 0x171b4:$b7: LogClientException 0x17129:$b8: PipeExists 0x16d78:$b9: IClientLoggingHost
Process Memory Space: IntelCpHeciSvc.exe PID: 5760	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x528a5b:$x1: NanoCore.ClientPluginHost 0x528a98:$x2: IClientNetworkHost 0x52c589:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x53760f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: IntelCpHeciSvc.exe PID: 5760	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: IntelCpHeciSvc.exe PID: 5760	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: IntelCpHeciSvc.exe PID: 5760	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x528728:$a: NanoCore 0x528738:$a: NanoCore 0x5287f7:$a: NanoCore 0x528806:$a: NanoCore 0x528a07:$a: NanoCore 0x528a1b:$a: NanoCore 0x528a5b:$a: NanoCore 0x533c79:$a: NanoCore 0x533c8b:$a: NanoCore 0x533cc7:$a: NanoCore 0x528787:$b: ClientPlugin 0x528850:$b: ClientPlugin 0x528a24:$b: ClientPlugin 0x528a64:$b: ClientPlugin 0x533c94:$b: ClientPlugin 0x533cd0:$b: ClientPlugin 0x528949:$c: ProjectData 0x533bc6:$c: ProjectData 0x52931d:$d: DESCrypto 0x534524:$d: DESCrypto 0x530cda:$e: KeepAlive
Process Memory Space: IntelCpHeciSvc.exe PID: 5760	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x528a5b:$a1: NanoCore.ClientPluginHost 0x528a1b:$a2: NanoCore.ClientPlugin 0x52a932:$b1: get_BuilderSettings 0x5287dc:$b2: ClientLoaderForm.resources 0x52a052:$b3: PluginCommand 0x528a4c:$b4: IClientAppHost 0x532e85:$b5: GetBlockHash 0x52af8a:$b6: AddHostEntry 0x5360a9:$b6: AddHostEntry 0x52ec7d:$b7: LogClientException 0x539bea:$b7: LogClientException 0x52aef7:$b8: PipeExists 0x53601d:$b8: PipeExists 0x528a85:$b9: IClientLoggingHost
Process Memory Space: IntelCpHeciSvc.exe PID: 6824	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x55e49:$x1: NanoCore.ClientPluginHost 0x5c133:$x1: NanoCore.ClientPluginHost 0x6e58b:$x1: NanoCore.ClientPluginHost 0x962c0:$x1: NanoCore.ClientPluginHost 0x55e63:$x2: IClientNetworkHost 0x5c160:$x2: IClientNetworkHost 0x6e5c8:$x2: IClientNetworkHost 0x962da:$x2: IClientNetworkHost 0x720b9:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7d13f:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: IntelCpHeciSvc.exe PID: 6824	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: IntelCpHeciSvc.exe PID: 6824	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x492f4:$a: NanoCore 0x55db3:$a: NanoCore 0x55e0c:$a: NanoCore 0x55e49:$a: NanoCore 0x55ec2:$a: NanoCore 0x5677b:$a: NanoCore 0x567ce:$a: NanoCore 0x56807:$a: NanoCore 0x5687a:$a: NanoCore 0x5c0e9:$a: NanoCore 0x5c0fe:$a: NanoCore 0x5c133:$a: NanoCore 0x612b5:$a: NanoCore 0x612c8:$a: NanoCore 0x612fa:$a: NanoCore 0x679ff:$a: NanoCore 0x67a13:$a: NanoCore 0x67f62:$a: NanoCore 0x6e258:$a: NanoCore 0x6e268:$a: NanoCore 0x6e327:$a: NanoCore
Process Memory Space: IntelCpHeciSvc.exe PID: 6824	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x55e49:$a1: NanoCore.ClientPluginHost 0x5c133:$a1: NanoCore.ClientPluginHost 0x6e58b:$a1: NanoCore.ClientPluginHost 0x962c0:$a1: NanoCore.ClientPluginHost 0x55e0c:$a2: NanoCore.ClientPlugin 0x5c0fe:$a2: NanoCore.ClientPlugin 0x6e54b:$a2: NanoCore.ClientPlugin 0x96283:$a2: NanoCore.ClientPlugin 0x561c3:$b1: get_BuilderSettings 0x60f05:$b1: get_BuilderSettings 0x70462:$b1: get_BuilderSettings 0x96626:$b1: get_BuilderSettings 0x6e30c:$b2: ClientLoaderForm.resources 0x6fb82:$b3: PluginCommand 0x55e97:$b4: IClientAppHost 0x6e57c:$b4: IClientAppHost 0x9630e:$b4: IClientAppHost 0x789b5:$b5: GetBlockHash 0x56234:$b6: AddHostEntry 0x70aba:$b6: AddHostEntry 0x7bbd9:$b6: AddHostEntry
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.IntelCpHeciSvc.exe.400000.0.unpack	MAL_Malware_Imphash_Mar23_1	Detects malware by known bad imphash or rich_pe_header_hash	Arnim Rupp
0.0.IntelCpHeciSvc.exe.400000.0.unpack	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth (Nextron Systems)	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
0.0.IntelCpHeciSvc.exe.400000.0.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
0.0.IntelCpHeciSvc.exe.400000.0.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
3.2.dhcpmon.exe.134f6ddc.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
3.2.dhcpmon.exe.134f6ddc.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
3.2.dhcpmon.exe.134f6ddc.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.dhcpmon.exe.134f6ddc.3.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
3.2.dhcpmon.exe.134f6ddc.3.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xd978:$x2: NanoCore.ClientPlugin 0xd9ad:$x3: NanoCore.ClientPluginHost 0xd96c:$i2: IClientData 0xd98e:$i3: IClientNetwork 0xd99d:$i5: IClientDataHost 0xd9c7:$i6: IClientLoggingHost 0xd9da:$i7: IClientNetworkHost 0xd9ed:$i8: IClientUIHost 0xd9fb:$i9: IClientNameObjectCollection 0xda17:$i10: IClientReadOnlyNameObjectCollection 0xd76a:$s1: ClientPlugin 0xd981:$s1: ClientPlugin 0x129a2:$s6: get_ClientSettings
1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xd9ad:$a1: NanoCore.ClientPluginHost 0xd978:$a2: NanoCore.ClientPlugin 0x128f3:$b1: get_BuilderSettings 0x12862:$b7: LogClientException 0xd9c7:$b9: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0xb165:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin 0xb158:$s1: ClientPlugin 0x10179:$s6: get_ClientSettings
1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost
3.2.dhcpmon.exe.34cc9d0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
3.2.dhcpmon.exe.34cc9d0.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
3.2.dhcpmon.exe.34cc9d0.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
3.2.dhcpmon.exe.34cc9d0.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0xf78e:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin 0xf781:$s1: ClientPlugin 0x147a2:$s6: get_ClientSettings
1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xfef5:$x1: NanoCore Client 0xff05:$x1: NanoCore Client 0x1014d:$x2: NanoCore.ClientPlugin 0x1018d:$x3: NanoCore.ClientPluginHost 0x10142:$i1: IClientApp 0x10163:$i2: IClientData 0x1016f:$i3: IClientNetwork 0x1017e:$i4: IClientAppHost 0x101a7:$i5: IClientDataHost 0x101b7:$i6: IClientLoggingHost 0x101ca:$i7: IClientNetworkHost 0x101dd:$i8: IClientUIHost 0x101eb:$i9: IClientNameObjectCollection 0x10207:$i10: IClientReadOnlyNameObjectCollection 0xff54:$s1: ClientPlugin 0x10156:$s1: ClientPlugin 0x1064a:$s2: EndPoint 0x10653:$s3: IPAddress 0x1065d:$s4: IPEndPoint 0x12093:$s6: get_ClientSettings 0x12637:$s7: get_Connected
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.0.IntelCpHeciSvc.exe.6c0000.0.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1018d:$a1: NanoCore.ClientPluginHost 0x1014d:$a2: NanoCore.ClientPlugin 0x120a6:$b1: get_BuilderSettings 0xffa9:$b2: ClientLoaderForm.resources 0x117c6:$b3: PluginCommand 0x1017e:$b4: IClientAppHost 0x1a5fe:$b5: GetBlockHash 0x126fe:$b6: AddHostEntry 0x163f1:$b7: LogClientException 0x1266b:$b8: PipeExists 0x101b7:$b9: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1b800000.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
1.2.IntelCpHeciSvc.exe.1b800000.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.1b800000.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
1.2.IntelCpHeciSvc.exe.1b800000.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
3.2.dhcpmon.exe.134f6ddc.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28281:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x282ae:$x2: IClientNetworkHost
3.2.dhcpmon.exe.134f6ddc.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28281:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x2935c:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x2829b:$s5: IClientLoggingHost
3.2.dhcpmon.exe.134f6ddc.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.dhcpmon.exe.134f6ddc.3.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xf778:$x2: NanoCore.ClientPlugin 0x2824c:$x2: NanoCore.ClientPlugin 0xf7ad:$x3: NanoCore.ClientPluginHost 0x28281:$x3: NanoCore.ClientPluginHost 0xf76c:$i2: IClientData 0x28240:$i2: IClientData 0xf78e:$i3: IClientNetwork 0x28262:$i3: IClientNetwork 0xf79d:$i5: IClientDataHost 0x28271:$i5: IClientDataHost 0xf7c7:$i6: IClientLoggingHost 0x2829b:$i6: IClientLoggingHost 0xf7da:$i7: IClientNetworkHost 0x282ae:$i7: IClientNetworkHost 0xf7ed:$i8: IClientUIHost 0x282c1:$i8: IClientUIHost 0xf7fb:$i9: IClientNameObjectCollection 0x282cf:$i9: IClientNameObjectCollection 0xf817:$i10: IClientReadOnlyNameObjectCollection 0x282eb:$i10: IClientReadOnlyNameObjectCollection 0xf56a:$s1: ClientPlugin
3.2.dhcpmon.exe.134f6ddc.3.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xf7ad:$a1: NanoCore.ClientPluginHost 0x28281:$a1: NanoCore.ClientPluginHost 0xf778:$a2: NanoCore.ClientPlugin 0x2824c:$a2: NanoCore.ClientPlugin 0x146f3:$b1: get_BuilderSettings 0x2d1c7:$b1: get_BuilderSettings 0x14662:$b7: LogClientException 0x2d136:$b7: LogClientException 0xf7c7:$b9: IClientLoggingHost 0x2829b:$b9: IClientLoggingHost
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d0b7:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d0e4:$x2: IClientNetworkHost
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d0b7:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e192:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d0d1:$s5: IClientLoggingHost
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0x145ae:$x2: NanoCore.ClientPlugin 0x2d082:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0x145e3:$x3: NanoCore.ClientPluginHost 0x2d0b7:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0x145a2:$i2: IClientData 0x2d076:$i2: IClientData 0xe29:$i3: IClientNetwork 0x145c4:$i3: IClientNetwork 0x2d098:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0x145d3:$i5: IClientDataHost 0x2d0a7:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0x145fd:$i6: IClientLoggingHost 0x2d0d1:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d06d:$a: NanoCore 0x2d082:$a: NanoCore 0x2d0b7:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2ce29:$b: ClientPlugin 0x2ce44:$b: ClientPlugin
3.2.dhcpmon.exe.134f1fa6.4.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0x145e3:$a1: NanoCore.ClientPluginHost 0x2d0b7:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x145ae:$a2: NanoCore.ClientPlugin 0x2d082:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0x19529:$b1: get_BuilderSettings 0x31ffd:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x19498:$b7: LogClientException 0x31f6c:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost 0x145fd:$b9: IClientLoggingHost 0x2d0d1:$b9: IClientLoggingHost
3.2.dhcpmon.exe.134fb405.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x1: NanoCore.ClientPluginHost 0x23c58:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x23c85:$x2: IClientNetworkHost
3.2.dhcpmon.exe.134fb405.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xb184:$x2: NanoCore.ClientPluginHost 0x23c58:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x24d33:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x23c72:$s5: IClientLoggingHost
3.2.dhcpmon.exe.134fb405.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
3.2.dhcpmon.exe.134fb405.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xb14f:$x2: NanoCore.ClientPlugin 0x23c23:$x2: NanoCore.ClientPlugin 0xb184:$x3: NanoCore.ClientPluginHost 0x23c58:$x3: NanoCore.ClientPluginHost 0xb143:$i2: IClientData 0x23c17:$i2: IClientData 0xb165:$i3: IClientNetwork 0x23c39:$i3: IClientNetwork 0xb174:$i5: IClientDataHost 0x23c48:$i5: IClientDataHost 0xb19e:$i6: IClientLoggingHost 0x23c72:$i6: IClientLoggingHost 0xb1b1:$i7: IClientNetworkHost 0x23c85:$i7: IClientNetworkHost 0xb1c4:$i8: IClientUIHost 0x23c98:$i8: IClientUIHost 0xb1d2:$i9: IClientNameObjectCollection 0x23ca6:$i9: IClientNameObjectCollection 0xb1ee:$i10: IClientReadOnlyNameObjectCollection 0x23cc2:$i10: IClientReadOnlyNameObjectCollection 0xaf41:$s1: ClientPlugin
3.2.dhcpmon.exe.134fb405.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xb184:$a1: NanoCore.ClientPluginHost 0x23c58:$a1: NanoCore.ClientPluginHost 0xb14f:$a2: NanoCore.ClientPlugin 0x23c23:$a2: NanoCore.ClientPlugin 0x100ca:$b1: get_BuilderSettings 0x28b9e:$b1: get_BuilderSettings 0x10039:$b7: LogClientException 0x28b0d:$b7: LogClientException 0xb19e:$b9: IClientLoggingHost 0x23c72:$b9: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.2dc6ec8.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
1.2.IntelCpHeciSvc.exe.2dc6ec8.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth (Nextron Systems)	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
1.2.IntelCpHeciSvc.exe.2dc6ec8.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0xe38:$x2: NanoCore.ClientPlugin 0xe75:$x3: NanoCore.ClientPluginHost 0xe5a:$i1: IClientApp 0xe4e:$i2: IClientData 0xe29:$i3: IClientNetwork 0xec3:$i4: IClientAppHost 0xe65:$i5: IClientDataHost 0xeb0:$i6: IClientLoggingHost 0xe8f:$i7: IClientNetworkHost 0xea2:$i8: IClientUIHost 0xed2:$i9: IClientNameObjectCollection 0xef7:$i10: IClientReadOnlyNameObjectCollection 0xe41:$s1: ClientPlugin 0x177c:$s1: ClientPlugin 0x1789:$s1: ClientPlugin 0x11f9:$s6: get_ClientSettings 0x1249:$s7: get_Connected
1.2.IntelCpHeciSvc.exe.2dc6ec8.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0xe75:$a1: NanoCore.ClientPluginHost 0xe38:$a2: NanoCore.ClientPlugin 0x120c:$b1: get_BuilderSettings 0xec3:$b4: IClientAppHost 0x127d:$b6: AddHostEntry 0x12ec:$b7: LogClientException 0x1261:$b8: PipeExists 0xeb0:$b9: IClientLoggingHost
Click to see the 53 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe, ProcessId: 6824, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.403891013.00000000134B0000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "7d265ee0-5eff-4ffb-9f35-947e4a7e", "Group": "Default", "Domain1": "", "Domain2": "googleusercontent.ddns.net", "Port": 54984, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Source: IntelCpHeciSvc.exe	ReversingLabs: Detection: 97%
Source: IntelCpHeciSvc.exe	Virustotal: Detection: 90%			Perma Link

Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Avira: detection malicious, Label: W32/Neshta.A

Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	ReversingLabs: Detection: 95%
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Virustotal: Detection: 92%	Perma Link
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	ReversingLabs: Detection: 95%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.132\GoogleUpdateSetup.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\Install\{3560B2D0-8C42-4C08-AD8B-F3DF39FC149C}\GoogleUpdateSetup.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	ReversingLabs: Detection: 96%

Source: Yara match	File source: IntelCpHeciSvc.exe, type: SAMPLE
Source: Yara match	File source: 3.2.dhcpmon.exe.134f6ddc.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.IntelCpHeciSvc.exe.1bd60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.IntelCpHeciSvc.exe.1bd64629.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.IntelCpHeciSvc.exe.1bd60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.IntelCpHeciSvc.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.dhcpmon.exe.134f6ddc.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.dhcpmon.exe.134f1fa6.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.dhcpmon.exe.134fb405.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.403891013.00000000134B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.403372406.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IntelCpHeciSvc.exe PID: 5760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IntelCpHeciSvc.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\DHCP Monitor\dhcpmon.exe, type: DROPPED

Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Directory created: C:\Program Files\DHCP Monitor			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Directory created: C:\Program Files\DHCP Monitor\dhcpmon.exe			Jump to behavior

Source:	Binary string: C:\Windows\dll\mscorlib.pdbv source: IntelCpHeciSvc.exe, 00000001.00000002.610031860.0000000000B66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 4e089\mscorlib.pdb source: IntelCpHeciSvc.exe, 00000001.00000002.610031860.0000000000B66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbSpec source: IntelCpHeciSvc.exe, 00000001.00000002.610031860.0000000000B66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\mscorlib.pdbpdblib.pdb source: IntelCpHeciSvc.exe, 00000001.00000002.610031860.0000000000B66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: IntelCpHeciSvc.exe, 00000001.00000002.610031860.0000000000B66000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\Install\{3560B2D0-8C42-4C08-AD8B-F3DF39FC149C}\GoogleUpdateSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Users\user\AppData\Local\Temp\CR_14C6C.tmp\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Adobe\ARM\S\1977\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.132\GoogleUpdateSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Adobe\ARM\S\11399\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	System file written: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Jump to behavior

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\Application Data\
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\S\11399\
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\

Source: Malware configuration extractor	URLs:
Source: Malware configuration extractor	URLs: googleusercontent.ddns.net

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A93288
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A9301D
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A9CFB9
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A997AD
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A9CD1D
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A9EB58
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Code function: 1_2_00007FFDC2A932B9
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Code function: 3_2_00007FFDC2A83040
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Code function: 3_2_00007FFDC2A832B9

Source: IntelCpHeciSvc.exe, 00000000.00000002.609608819.0000000000190000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.610283998.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.615813689.0000000000D50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLzma#.dll4 vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.619633331.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClientPlugin.dll4 vs IntelCpHeciSvc.exe
Source: IntelCpHeciSvc.exe, 00000001.00000002.627685119.0000000012E1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs IntelCpHeciSvc.exe

Source: unknown	Process created: C:\Users\user\Desktop\IntelCpHeciSvc.exe C:\Users\user\Desktop\IntelCpHeciSvc.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe "C:\Users\user~1\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe"
Source: unknown	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~1\DHCPMO~1\dhcpmon.exe"
Source: C:\Windows\svchost.com	Process created: C:\Program Files\DHCP Monitor\dhcpmon.exe C:\PROGRA~1\DHCPMO~1\dhcpmon.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe "C:\Users\user~1\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe"
Source: C:\Windows\svchost.com	Process created: C:\Program Files\DHCP Monitor\dhcpmon.exe C:\PROGRA~1\DHCPMO~1\dhcpmon.exe

Source: IntelCpHeciSvc.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.32%
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\077cf2bd55145d691314f0889d7a1997\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\077cf2bd55145d691314f0889d7a1997\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{7d265ee0-5eff-4ffb-9f35-947e4a7e76b0}
Source: C:\Windows\svchost.com	Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush. svchost.com n X . t N t h ` T 5 @

Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: IntelCpHeciSvc.exe.0.dr, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\ProgramData\Adobe\ARM\S\11399\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\ProgramData\Adobe\ARM\S\1977\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\ARM\S\11399\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\ARM\S\1977\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IntelCpHeciSvc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: NanoCore

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

Windows Analysis Report
IntelCpHeciSvc.exe

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	File created: C:\Program Files\DHCP Monitor\dhcpmon.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Windows\svchost.com
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\Install\{3560B2D0-8C42-4C08-AD8B-F3DF39FC149C}\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Users\user\AppData\Local\Temp\CR_14C6C.tmp\setup.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\ARM\S\1977\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.132\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Adobe\ARM\S\11399\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	File created: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DHCP Monitor			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DHCP Monitor			Jump to behavior

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe TID: 6956	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe TID: 6964	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Oarpmany.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\MSOUC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{3560B2D0-8C42-4C08-AD8B-F3DF39FC149C}\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CR_14C6C.tmp\setup.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOSQM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\S\1977\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\FIRSTRUN.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\lynchtmlconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.132\GoogleUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\S\11399\AdobeARMHelper.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CSISYNCCLIENT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ODeploy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\OFFICE16\CMigrate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\IntelCpHeciSvc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3582-490\IntelCpHeciSvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.catum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mumum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mumum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: IntelCpHeciSvc.exe, 00000001.00000003.547251042.000000001B84A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mumum.mum
Source: svchost.com, 00000002.00000003.429290618.000000000220C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mwHyperV-Compute-System-VirtualMachine-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum

Source: IntelCpHeciSvc.exe, 00000001.00000003.359611397.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.362405323.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/user/AppData/Local/Temp/3582-490/en-US/SurveillanceExClientPlugin.resources.EXE
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.396136976.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersk\AppData\Local\Temp\3582-490\en\SurveillanceExClientPlugin.resources.DLL
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.396136976.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.484908244.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert.ddns.net
Source: IntelCpHeciSvc.exe, 00000001.00000003.482442583.0000000000C64000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.482937315.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert.ddns.netb
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000002.619633331.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000002.619633331.0000000003122000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.396136976.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.484908244.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageruld be made because the target machine actively refused it.
Source: IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.359470257.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersk\AppData\Local\Temp\3582-490\en\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.EXE
Source: IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360303205.0000000000C68000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360450418.0000000000C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/user/AppData/Local/Temp/3582-490/en/SurveillanceExClientPlugin.resources.EXE
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.359470257.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersk\AppData\Local\Temp\3582-490\en-US\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.DLLb
Source: IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/user/AppData/Local/Temp/3582-490/en/SurveillanceExClientPlugin.resources.DLL8
Source: IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.362405323.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager/user/AppData/Local/Temp/3582-490/en/SurveillanceExClientPlugin.resources/SurveillanceExClientPlugin.resources.DLL
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.482442583.0000000000C64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert.ddns.net[
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.363648013.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.484908244.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert.ddns.netz
Source: IntelCpHeciSvc.exe, 00000001.00000003.360450418.0000000000C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerindow.0.app.0.378734a
Source: IntelCpHeciSvc.exe, 00000001.00000003.443147694.0000000000C61000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.482442583.0000000000C64000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.455171072.0000000000C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert.ddns.net8
Source: IntelCpHeciSvc.exe, 00000001.00000003.396136976.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.359470257.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager@w
Source: IntelCpHeciSvc.exe, 00000001.00000003.359611397.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersk\AppData\Local\Temp\3582-490\en\SurveillanceEx
Source: IntelCpHeciSvc.exe, 00000001.00000003.396136976.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.360168853.0000000000C67000.00000004.00000020.00020000.00000000.sdmp, IntelCpHeciSvc.exe, 00000001.00000003.359470257.0000000000C66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managersk\AppData\Local\Temp\3582-490\en\SurveillanceExClientPlugin.resources\SurveillanceExClientPlugin.resources.DLL

Source: IntelCpHeciSvc.exe, 00000000.00000003.477943862.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: IntelCpHeciSvc.exe, 00000000.00000003.477943862.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: IntelCpHeciSvc.exe, 00000000.00000003.341781141.0000000002184000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: IntelCpHeciSvc.exe, 00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: IntelCpHeciSvc.exe, 00000001.00000002.629221700.000000001B800000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: IntelCpHeciSvc.exe, 00000001.00000002.630261931.000000001BD60000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: IntelCpHeciSvc.exe, 00000001.00000000.342421463.00000000006C2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: IntelCpHeciSvc.exe, 00000001.00000002.619633331.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: IntelCpHeciSvc.exe, 00000001.00000002.619633331.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll