Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
fLNzmBM9hR.exe

Overview

General Information

Sample name:fLNzmBM9hR.exe
renamed because original name is a hash value
Original sample name:14239732dbddfe922c297fdeac56a062.exe
Analysis ID:1446518
MD5:14239732dbddfe922c297fdeac56a062
SHA1:3f4f6454c4a2c1c5d1e10d5f841ce14eef00a785
SHA256:1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
Tags:exeNanoCoreRAT
Infos:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • fLNzmBM9hR.exe (PID: 6540 cmdline: "C:\Users\user\Desktop\fLNzmBM9hR.exe" MD5: 14239732DBDDFE922C297FDEAC56A062)
    • powershell.exe (PID: 7088 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 5480 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • schtasks.exe (PID: 7100 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • MSBuild.exe (PID: 7012 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
      • WerFault.exe (PID: 7120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 1416 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • dgKDUvhlvCiVpa.exe (PID: 6960 cmdline: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe MD5: 14239732DBDDFE922C297FDEAC56A062)
    • schtasks.exe (PID: 7248 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • MSBuild.exe (PID: 7292 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
  • dnshost.exe (PID: 7492 cmdline: "C:\Program Files (x86)\DNS Host\dnshost.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
    • conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Nanocore RAT, NanoCoreNanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.
  • APT33
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "1fa46b72-10f9-4da3-bc15-84dde165", "Group": "NewBin", "Domain1": "newsddawork.3utilities.com", "Domain2": "maxlogs.webhop.me", "Port": 1620, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmpWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
  • 0xe75:$a1: NanoCore.ClientPluginHost
  • 0xe38:$a2: NanoCore.ClientPlugin
  • 0x120c:$b1: get_BuilderSettings
  • 0xec3:$b4: IClientAppHost
  • 0x127d:$b6: AddHostEntry
  • 0x12ec:$b7: LogClientException
  • 0x1261:$b8: PipeExists
  • 0xeb0:$b9: IClientLoggingHost
00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0xe75:$x1: NanoCore.ClientPluginHost
  • 0xe8f:$x2: IClientNetworkHost
00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmpMALWARE_Win_NanoCoreDetects NanoCoreditekSHen
  • 0xe38:$x2: NanoCore.ClientPlugin
  • 0xe75:$x3: NanoCore.ClientPluginHost
  • 0xe5a:$i1: IClientApp
  • 0xe4e:$i2: IClientData
  • 0xe29:$i3: IClientNetwork
  • 0xec3:$i4: IClientAppHost
  • 0xe65:$i5: IClientDataHost
  • 0xeb0:$i6: IClientLoggingHost
  • 0xe8f:$i7: IClientNetworkHost
  • 0xea2:$i8: IClientUIHost
  • 0xed2:$i9: IClientNameObjectCollection
  • 0xef7:$i10: IClientReadOnlyNameObjectCollection
  • 0xe41:$s1: ClientPlugin
  • 0x177c:$s1: ClientPlugin
  • 0x1789:$s1: ClientPlugin
  • 0x11f9:$s6: get_ClientSettings
  • 0x1249:$s7: get_Connected
00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmpWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
  • 0x5b0b:$a1: NanoCore.ClientPluginHost
  • 0x5b87:$a2: NanoCore.ClientPlugin
  • 0x6710:$b7: LogClientException
  • 0x5b25:$b9: IClientLoggingHost
00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmpNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x5b0b:$x1: NanoCore.ClientPluginHost
  • 0x5b44:$x2: IClientNetworkHost
Click to see the 88 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
6.2.MSBuild.exe.7720000.16.unpackWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
  • 0x6da5:$a1: NanoCore.ClientPluginHost
  • 0x6d7f:$a2: NanoCore.ClientPlugin
  • 0x6dbf:$b9: IClientLoggingHost
6.2.MSBuild.exe.7720000.16.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x6da5:$x1: NanoCore.ClientPluginHost
  • 0x6dd2:$x2: IClientNetworkHost
6.2.MSBuild.exe.7720000.16.unpackMALWARE_Win_NanoCoreDetects NanoCoreditekSHen
  • 0x6d7f:$x2: NanoCore.ClientPlugin
  • 0x6da5:$x3: NanoCore.ClientPluginHost
  • 0x6d70:$i3: IClientNetwork
  • 0x6d95:$i5: IClientDataHost
  • 0x6dbf:$i6: IClientLoggingHost
  • 0x6dd2:$i7: IClientNetworkHost
  • 0x6de5:$i9: IClientNameObjectCollection
  • 0x6b02:$s1: ClientPlugin
  • 0x6d88:$s1: ClientPlugin
6.2.MSBuild.exe.464513e.10.unpackWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
  • 0x3d99:$a1: NanoCore.ClientPluginHost
  • 0xcd3b:$a1: NanoCore.ClientPluginHost
  • 0x3d70:$a2: NanoCore.ClientPlugin
  • 0xcd12:$a2: NanoCore.ClientPlugin
  • 0x3d86:$b9: IClientLoggingHost
  • 0xcd28:$b9: IClientLoggingHost
6.2.MSBuild.exe.7710000.15.unpackWindows_Trojan_Nanocore_d8c4e3c5unknownunknown
  • 0x2dbb:$a1: NanoCore.ClientPluginHost
  • 0x2d96:$a2: NanoCore.ClientPlugin
  • 0x6758:$b1: get_BuilderSettings
  • 0x2dac:$b4: IClientAppHost
Click to see the 208 entries

Sigma Signatures

AV Detection

barindex
Sigma detected: NanoCore
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7012, TargetFilename: C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\run.dat

E-Banking Fraud

barindex
Sigma detected: NanoCore
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7012, TargetFilename: C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\run.dat

System Summary

barindex
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fLNzmBM9hR.exe", ParentImage: C:\Users\user\Desktop\fLNzmBM9hR.exe, ParentProcessId: 6540, ParentProcessName: fLNzmBM9hR.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", ProcessId: 7088, ProcessName: powershell.exe
Sigma detected: Powershell Defender Exclusion
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fLNzmBM9hR.exe", ParentImage: C:\Users\user\Desktop\fLNzmBM9hR.exe, ParentProcessId: 6540, ParentProcessName: fLNzmBM9hR.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", ProcessId: 7088, ProcessName: powershell.exe
Sigma detected: Suspicious Add Scheduled Task Parent
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe, ParentImage: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe, ParentProcessId: 6960, ParentProcessName: dgKDUvhlvCiVpa.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp", ProcessId: 7248, ProcessName: schtasks.exe
Sigma detected: Suspicious Schtasks From Env Var Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\fLNzmBM9hR.exe", ParentImage: C:\Users\user\Desktop\fLNzmBM9hR.exe, ParentProcessId: 6540, ParentProcessName: fLNzmBM9hR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", ProcessId: 7100, ProcessName: schtasks.exe
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\DNS Host\dnshost.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7012, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNS Host
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fLNzmBM9hR.exe", ParentImage: C:\Users\user\Desktop\fLNzmBM9hR.exe, ParentProcessId: 6540, ParentProcessName: fLNzmBM9hR.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe", ProcessId: 7088, ProcessName: powershell.exe

Persistence and Installation Behavior

barindex
Sigma detected: Scheduled temp file as task from temp location
Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\fLNzmBM9hR.exe", ParentImage: C:\Users\user\Desktop\fLNzmBM9hR.exe, ParentProcessId: 6540, ParentProcessName: fLNzmBM9hR.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp", ProcessId: 7100, ProcessName: schtasks.exe

Stealing of Sensitive Information

barindex
Sigma detected: NanoCore
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7012, TargetFilename: C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\run.dat

Remote Access Functionality

barindex
Sigma detected: NanoCore
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7012, TargetFilename: C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\run.dat

Snort Signatures

Timestamp:05/23/24-15:47:18.239422
SID:2046914
Source Port:49744
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:30.409016
SID:2046914
Source Port:49746
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:49.518159
SID:2046914
Source Port:49749
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:36.408636
SID:2046914
Source Port:49747
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:48:01.127491
SID:2046914
Source Port:49752
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:04.830476
SID:2046914
Source Port:49736
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:46:58.783649
SID:2046914
Source Port:49732
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:50.030323
SID:2046917
Source Port:1620
Destination Port:49749
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:29.411754
SID:2816718
Source Port:49746
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:24.267940
SID:2046914
Source Port:49745
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:45.326170
SID:2046909
Source Port:1620
Destination Port:49748
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:43.543709
SID:2046914
Source Port:49748
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:55.533842
SID:2046914
Source Port:49751
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:05/23/24-15:47:12.142968
SID:2046914
Source Port:49737
Destination Port:1620
Protocol:TCP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: fLNzmBM9hR.exeAvira: detected
Antivirus detection for URL or domain
Source: maxlogs.webhop.meAvira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeAvira: detection malicious, Label: TR/AD.Nanocore.ihehd
Found malware configuration
Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "1fa46b72-10f9-4da3-bc15-84dde165", "Group": "NewBin", "Domain1": "newsddawork.3utilities.com", "Domain2": "maxlogs.webhop.me", "Port": 1620, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}
Multi AV Scanner detection for domain / URL
Source: maxlogs.webhop.meVirustotal: Detection: 11%Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeVirustotal: Detection: 74%Perma Link
Multi AV Scanner detection for submitted file
Source: fLNzmBM9hR.exeVirustotal: Detection: 74%Perma Link
Source: fLNzmBM9hR.exeReversingLabs: Detection: 76%
Yara detected Nanocore RAT
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTR
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeJoe Sandbox ML: detected
Machine Learning detection for sample
Source: fLNzmBM9hR.exeJoe Sandbox ML: detected
Source: fLNzmBM9hR.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: fLNzmBM9hR.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Xml.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreStressTester.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: Accessibility.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: FileBrowserClient.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreBase.pdb\ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: System.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Windows.Forms.pdbl source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Windows.Forms.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: mscorlib.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.pdb7 source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.ni.pdbRSDSJ< source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.pdbH source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Drawing.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.dr
Source: Binary string: mscorlib.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPlugin.pdbh source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: MSBuild.exe, 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: dows\exe\MSBuild.pdb4 source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdbMZ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPluginNew.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: MyClientPluginNew.pdbMZ@ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPlugin.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: NanoCoreBase.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreStressTester.pdbt^ source: WERC6F3.tmp.dmp.20.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]6_2_06ACE4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]6_2_077D02C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]6_2_077D02B9

Networking

barindex
Snort IDS alert for network traffic
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49732 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49736 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49737 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49744 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49745 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49746 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.2.4:49746 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49747 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49748 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046909 ET TROJAN NanoCore RAT Keepalive Response 1 104.243.242.165:1620 -> 192.168.2.4:49748
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49749 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046917 ET TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 104.243.242.165:1620 -> 192.168.2.4:49749
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49751 -> 104.243.242.165:1620
Source: TrafficSnort IDS: 2046914 ET TROJAN NanoCore RAT CnC 7 192.168.2.4:49752 -> 104.243.242.165:1620
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractorURLs: maxlogs.webhop.me
Source: Malware configuration extractorURLs: newsddawork.3utilities.com
Source: global trafficTCP traffic: 192.168.2.4:49732 -> 104.243.242.165:1620
Source: Joe Sandbox ViewASN Name: VOXILITYGB VOXILITYGB
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.126.151
Source: unknownTCP traffic detected without corresponding DNS query: 2.19.126.151
Source: global trafficDNS traffic detected: DNS query: newsddawork.3utilities.com
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://google.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1673750956.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, dgKDUvhlvCiVpa.exe, 00000007.00000002.1695292378.0000000002B42000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.20.drString found in binary or memory: http://upx.sf.net
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmp, fLNzmBM9hR.exe, 00000000.00000002.1676472894.0000000005FAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: fLNzmBM9hR.exe, 00000000.00000002.1676427170.0000000005F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
Source: fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: MSBuild.exe, 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: RegisterRawInputDevicesmemstr_d3b6dba2-6

E-Banking Fraud

barindex
Yara detected Nanocore RAT
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTR

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3087398590.0000000004543000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects NanoCore Author: ditekSHen
Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: detect Nanocore in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeCode function: 0_2_00D6D2E40_2_00D6D2E4
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeCode function: 0_2_04A955200_2_04A95520
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeCode function: 0_2_04A936280_2_04A93628
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeCode function: 0_2_04A90AB90_2_04A90AB9
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeCode function: 0_2_04A90AC80_2_04A90AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_017ED3446_2_017ED344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_06ACB6586_2_06ACB658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_06AC1D586_2_06AC1D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_06ACC2706_2_06ACC270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_06ACC32E6_2_06ACC32E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_06AC01406_2_06AC0140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D37986_2_077D3798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077DB6606_2_077DB660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077DAD606_2_077DAD60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D65B86_2_077D65B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D4C906_2_077D4C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077DA4906_2_077DA490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D43B06_2_077D43B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D446E6_2_077D446E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D728E6_2_077D728E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077DA1486_2_077DA148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D71D06_2_077D71D0
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_00F1D2E47_2_00F1D2E4
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_00FD49407_2_00FD4940
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_00FD2A487_2_00FD2A48
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B47587_2_071B4758
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B3BF87_2_071B3BF8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B47487_2_071B4748
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B36377_2_071B3637
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B36487_2_071B3648
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BD6B07_2_071BD6B0
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BB5D07_2_071BB5D0
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BCCA87_2_071BCCA8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B3BE87_2_071B3BE8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BBA087_2_071BBA08
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BF9507_2_071BF950
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071BF9607_2_071BF960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 11_2_0155D34411_2_0155D344
Source: C:\Program Files (x86)\DNS Host\dnshost.exeCode function: 12_2_00E55A4912_2_00E55A49
Source: C:\Program Files (x86)\DNS Host\dnshost.exeCode function: 12_2_00E52B9012_2_00E52B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 1416
Source: fLNzmBM9hR.exe, 00000000.00000002.1677098272.0000000007567000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameschtasks.exej% vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exe, 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exe, 00000000.00000002.1672969464.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exe, 00000000.00000002.1676153949.00000000054E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSimpleLogin.dll8 vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exe, 00000000.00000002.1677607202.0000000007B40000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exeBinary or memory string: OriginalFilenameXBxR.exe. vs fLNzmBM9hR.exe
Source: fLNzmBM9hR.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7720000.16.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.464513e.10.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7710000.15.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.79f0000.24.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a30000.28.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.77e0000.23.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a30000.28.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7780000.20.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.2f6db24.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.79f0000.24.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.77e0000.23.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a00000.26.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7790000.21.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7770000.19.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.455fa58.7.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a04c9f.27.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7710000.15.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.32c5c84.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7760000.18.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7790000.21.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.463c30f.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7750000.17.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.464513e.10.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.465356e.8.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7720000.16.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.455fa58.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.465356e.8.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.5f20000.11.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7780000.20.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.77a0000.22.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.455163c.6.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.77a0000.22.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a0e8a4.25.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7760000.18.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.7a00000.26.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.32d1e90.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.326d510.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.45646f7.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.MSBuild.exe.463c30f.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.455163c.6.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.MSBuild.exe.32c5c84.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.MSBuild.exe.32d1e90.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.MSBuild.exe.32e649c.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3087398590.0000000004543000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTRMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTRMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTRMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTRMatched rule: Nanocore author = JPCERT/CC Incident Response Group, description = detect Nanocore in memory, rule_usage = memory scan, reference = internal research
Source: fLNzmBM9hR.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dgKDUvhlvCiVpa.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qVxXNKnhAcArgJoGGYXiyyQ--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qVxXNKnhAcArgJoGGYXiyyQ--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qVxXNKnhAcArgJoGGYXiyyQ--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qVxXNKnhAcArgJoGGYXiyyQ--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csCryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, Mt0ImfW2NMZoNJ1Hiu.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, Mt0ImfW2NMZoNJ1Hiu.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: _0020.SetAccessControl
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: _0020.AddAccessRule
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: _0020.SetAccessControl
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csSecurity API names: _0020.AddAccessRule
Source: 0.2.fLNzmBM9hR.exe.54c0000.5.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
Source: 0.2.fLNzmBM9hR.exe.2a56e68.0.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
Source: 0.2.fLNzmBM9hR.exe.2a46e50.1.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: dnshost.exe, 0000000C.00000002.1799913093.0000000002BB1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q%C:\Program Files (x86)\DNS Host\*.sln
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe, 0000000C.00000002.1799913093.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, dnshost.exe.6.drBinary or memory string: *.sln
Source: dnshost.exe, 0000000C.00000002.1798358511.0000000000B44000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Program Files (x86)\DNS Host\<.slnn<#N
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: MSBuild MyApp.csproj /t:Clean
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: /ignoreprojectextensions:.sln
Source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.drBinary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.
Source: classification engineClassification label: mal100.troj.evad.winEXE@19/23@16/1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Program Files (x86)\DNS HostJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile created: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMutant created: \Sessions\1\BaseNamedObjects\VORvjohFncKJWkVKKJ
Source: C:\Program Files (x86)\DNS Host\dnshost.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7012
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{1fa46b72-10f9-4da3-bc15-84dde165706d}
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile created: C:\Users\user\AppData\Local\Temp\tmp7751.tmpJump to behavior
Source: fLNzmBM9hR.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fLNzmBM9hR.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: fLNzmBM9hR.exeVirustotal: Detection: 74%
Source: fLNzmBM9hR.exeReversingLabs: Detection: 76%
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile read: C:\Users\user\Desktop\fLNzmBM9hR.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\fLNzmBM9hR.exe "C:\Users\user\Desktop\fLNzmBM9hR.exe"
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknownProcess created: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknownProcess created: C:\Program Files (x86)\DNS Host\dnshost.exe "C:\Program Files (x86)\DNS Host\dnshost.exe"
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 1416
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp"Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp"Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: mscoree.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: version.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: cryptsp.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: rsaenh.dll
Source: C:\Program Files (x86)\DNS Host\dnshost.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
Source: fLNzmBM9hR.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: fLNzmBM9hR.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Xml.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreStressTester.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: Accessibility.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: FileBrowserClient.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreBase.pdb\ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: mscorlib.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: System.Xml.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: System.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Xml.ni.pdbRSDS# source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: Microsoft.VisualBasic.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Windows.Forms.pdbl source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Windows.Forms.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: mscorlib.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.pdb7 source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.ni.pdbRSDSJ< source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.pdbH source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Drawing.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp, dnshost.exe, 0000000C.00000000.1790740476.00000000006E2000.00000002.00000001.01000000.0000000E.sdmp, dnshost.exe.6.dr
Source: Binary string: mscorlib.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPlugin.pdbh source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Management.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\MyNanoCore RemoteScripting\MyClientPlugin\obj\Debug\MyClientPluginNew.pdb source: MSBuild.exe, 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: dows\exe\MSBuild.pdb4 source: MSBuild.exe, 00000006.00000002.3078911934.00000000015F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Accessibility.pdbMZ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPluginNew.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: MyClientPluginNew.pdbMZ@ source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.ni.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: MyClientPlugin.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: NanoCoreBase.pdb source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERC6F3.tmp.dmp.20.dr
Source: Binary string: NanoCoreStressTester.pdbt^ source: WERC6F3.tmp.dmp.20.dr

Data Obfuscation

barindex
.NET source code contains potential unpacker
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.cs.Net Code: _0023_003Dqf3c4WtE_0024_0024thN5QyBMvo3u0lth2VF5hmfUsIv1r8yRkg_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.cs.Net Code: _0023_003Dq_FL69pQf17BUSAFbWYu1SStMAbdu_0024R1GJ8VY8UL5_EA_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, --qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU-.cs.Net Code: _0023_003DqKU0J1fiP8KA33eFK1owekQ_003D_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.cs.Net Code: _0023_003Dqf3c4WtE_0024_0024thN5QyBMvo3u0lth2VF5hmfUsIv1r8yRkg_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qjIje6jGWLd2EOkfZXKqBbg--.cs.Net Code: _0023_003Dq_FL69pQf17BUSAFbWYu1SStMAbdu_0024R1GJ8VY8UL5_EA_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, --qxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecU-.cs.Net Code: _0023_003DqKU0J1fiP8KA33eFK1owekQ_003D_003D System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KG7cbGbyJ7qmmE4UuJ.cs.Net Code: yvpR39ZiHZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KG7cbGbyJ7qmmE4UuJ.cs.Net Code: yvpR39ZiHZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.fLNzmBM9hR.exe.54e0000.6.raw.unpack, LoginForm.cs.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_00F1F478 push esp; iretd 7_2_00F1F479
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_00FD0D13 push eax; iretd 7_2_00FD0D1D
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7705 push ecx; iretd 7_2_071B7706
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B775E push eax; iretd 7_2_071B775F
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7749 push eax; iretd 7_2_071B774B
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7775 push eax; iretd 7_2_071B7776
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B77D6 push ax; iretd 7_2_071B77D8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B77C3 push eax; iretd 7_2_071B77C4
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B77F0 push eax; iretd 7_2_071B77F2
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B761B push edx; iretd 7_2_071B761C
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B769F push ecx; iretd 7_2_071B76A1
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B76B7 push ecx; iretd 7_2_071B76B8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B76DA push ecx; iretd 7_2_071B76DB
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B76ED push ecx; iretd 7_2_071B76EF
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7505 push ebx; iretd 7_2_071B7507
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7520 push ebx; iretd 7_2_071B7521
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7599 push edx; iretd 7_2_071B759A
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B75AD push edx; iretd 7_2_071B75AE
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B75C7 push edx; iretd 7_2_071B75C8
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B75EC push edx; iretd 7_2_071B75EE
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B740D push esp; iretd 7_2_071B740F
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B744E push ebx; iretd 7_2_071B7450
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B747A push ebx; iretd 7_2_071B747B
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7463 push ebx; iretd 7_2_071B7464
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B74F1 push ebx; iretd 7_2_071B74F3
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7310 push ebp; iretd 7_2_071B7316
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7327 push ebp; iretd 7_2_071B732D
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B7372 push esp; iretd 7_2_071B7373
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B738F push esp; iretd 7_2_071B7391
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B73BB push esp; iretd 7_2_071B73BC
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeCode function: 7_2_071B73A3 push esp; iretd 7_2_071B73A5
Source: fLNzmBM9hR.exeStatic PE information: section name: .text entropy: 7.9781458639858265
Source: dgKDUvhlvCiVpa.exe.0.drStatic PE information: section name: .text entropy: 7.9781458639858265
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, kneA8pFPEWPb7xDiGt.csHigh entropy of concatenated method names: 'LE0TkYUrhw', 'b92Tfis3WT', 'VRXTQbgweT', 'BYaTdJJ9gu', 'GjXTpdnJL5', 'MXRTPBk2RH', 'jW4TbfUINy', 'dJMTVjRgNj', 'agyT5btdTi', 'HbUTAxEQwC'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, VOWNRHQX9kUKKcoL7i.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fIbxClxsN7', 'THyxvmpG20', 'VFNxzur7lQ', 'aww0hZYeLT', 'oS20eLyA0N', 'HBP0xw6vKQ', 'b6W00vEOiD', 'sWGUMe4nfyA636cqhHS'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KlQkb2r7oFN52Q2qZe.csHigh entropy of concatenated method names: 'ToString', 'pOHGUtVLhe', 'lfsG71ffJT', 'q2cGspZEPs', 'EYsGmSXcA4', 'elIGLekvNe', 'nMcGI0ts9K', 'WrJGaW3F4D', 'AtpGnkIkXe', 'c0iGwG3DZ1'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, H56QvGabV6fscrZUYr.csHigh entropy of concatenated method names: 'u2IPkIIqGp', 'DxEPQLk8Rb', 'eEiPpsj4gl', 'k9Spv1USls', 'RwLpzjC2QC', 'UXCPhQXIgG', 'zf0PesVyCg', 'trIPxiZKDY', 'BcWP0bFxlv', 'BKTPRdUmlr'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, nxmtI7gx39DWI5vnUl.csHigh entropy of concatenated method names: 'RRHpDC56aw', 'OYepf5XTPQ', 'EWnpdQ7jfQ', 'hytpPSXtSM', 'fdVpbG7vcS', 'P3vd806QDT', 'E5gdB3rDyM', 'HlndjqoKVv', 'SXFdFSJxn2', 'FpRdCaZ1fm'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, SNZRMVe0WdymfJlynVe.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'r6NY4JEuY5', 'r0GYO8dkcQ', 'RICYraP9rt', 'fjWYZaPhch', 'SUvY83U25D', 'OiEYBKTyYZ', 'DTNYjSsape'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, p8SIOJzyxjsivyojIV.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'cZZlSSTn6x', 'iFKlM5nK5i', 'jTilGMmKke', 'l9ylyUDsue', 'sQ4lTSATjr', 'j2kll2hiJ4', 'zgOlYGmjim'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, oqdAOl97dxk3nqr3cY.csHigh entropy of concatenated method names: 'P7wdJRtQt2', 'BbldXXb4Uy', 'ioEQseG7Rs', 'iXmQmC5uGU', 'OAOQLQCCbp', 'RlRQI9vHfx', 'RsWQaDjYaM', 'EOZQnax6pc', 'RQVQwBLgmF', 'do9QH8eIEi'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, Vv1F3Ifw1mbQLiAjti.csHigh entropy of concatenated method names: 'Dispose', 'waVeCIQUdd', 'Prwx7jOsZO', 'kGbyyp7xZI', 'ibneveA8pP', 'tWPezb7xDi', 'ProcessDialogKey', 'ptRxhTafJC', 'zlRxeLvdPD', 'hEfxxQ8ZHe'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, sPwtxoehqmVp9W195LG.csHigh entropy of concatenated method names: 'nlVlq1dtAl', 'SJMli81HCy', 'mFul353nYy', 'fC7l2AF6WO', 'DJglJies54', 'sRJlKiYgG4', 'vaklXy7dmn', 'K6BlWtejXF', 'n3vloUJn24', 'FAjl9T1Q2S'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, Kc4J6S4Iblnb55We4o.csHigh entropy of concatenated method names: 'vyJMHEXSp7', 'wCgMud8ppU', 'orUM47KOrI', 'CnZMOGug4j', 'cQmM7in6EY', 'h52Mshe95x', 'TJbMmdCK3w', 'mtaMLmLHx0', 'qIXMIZZI40', 'zHBMabLnbH'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, dDlMY8RqgfYN8K0INW.csHigh entropy of concatenated method names: 'QenePt0Imf', 'ANMebZoNJ1', 'Pg0e5KJQWa', 'QJYeAJSqdA', 'xr3eMcYAxm', 'vI7eGx39DW', 'gxNZpHf5wSm3ka96Wl', 'keRQ6qtLOa93XpaTu0', 'AEMeeRtPkv', 'tfHe0D8rkQ'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, dTafJCC3lRLvdPDdEf.csHigh entropy of concatenated method names: 'jdxTgPRLiq', 'AWUT7UrRCx', 'cHxTsrjXQS', 'cr8TmuOYke', 'wnwT4Q2yun', 'pYCTLB4NRR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csHigh entropy of concatenated method names: 'ff90DkIOna', 'SaY0k8sjTV', 'oYf0f44rtA', 'khU0Q4q728', 'Kfm0dWpd4R', 'acX0pUJ6KN', 'QyK0PRBM6J', 'B680bhmkNC', 'Hlb0VyLJjD', 'hOt05P6tG4'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, OmbQxuxUcHKEMN2xZL.csHigh entropy of concatenated method names: 'c8Z3nD5wy', 'dKV2D91eu', 'uR7KfpQNw', 'bpUX5QXBJ', 'PeJoPvF7h', 'UGB9rjwuK', 'Qa22cJuJnWtC7gYR1V', 'fgBjRt2TIxCNAanFdO', 'VMrT4vpaL', 'tJoY6PXJi'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, hjHIYLB4SSpneZSvS0.csHigh entropy of concatenated method names: 'f8fyF9Gdi0', 'MaYyv4dM3T', 'NvFThNEkLm', 'GydTeKymv7', 'dDwyUqEerM', 'ghXyuOcqjb', 'TbqycZN1vm', 'l30y4CW03L', 'bamyOHiYMn', 'vU3yrOkxZL'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, x1Cfjuog0KJQWacJYJ.csHigh entropy of concatenated method names: 'UPaQ2PeUcM', 'jdcQKMtRxa', 'xMGQW9TDoi', 'Ga6Qo1lQRv', 'XODQMNa5Qq', 'flqQGEYVcJ', 'J60Qy80Y1g', 'eDUQTYBT0q', 'tQWQlU6Zg0', 'NQrQYf0Men'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, FPrNA1Z02HXpGH8rCh.csHigh entropy of concatenated method names: 'xiOy5R0ao2', 'q46yABaDjF', 'ToString', 'pPDyk6YqCc', 'f0AyfOSs8s', 'Y2VyQQEahy', 'AjmydRhqP8', 'E5Eyp9p2AE', 'DcJyPWkyX7', 'z4HybRHxxh'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, Mt0ImfW2NMZoNJ1Hiu.csHigh entropy of concatenated method names: 'QDif46Drsu', 'MmwfOTiPA0', 'QfHfrK5QrX', 'vE5fZ9l56w', 'JVuf8yUwsV', 'AxbfBx0TSa', 'ROXfjGZP7H', 'tXffF792Sf', 'uMefCqcGaD', 'XmFfvYoIBW'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, RlrJ8Bc659FMOLPpT3.csHigh entropy of concatenated method names: 'mJBSWdbYLI', 'o5USoi1ml2', 'GiqSgjmvsF', 'UTqS7owb9m', 'LyOSmWWxJG', 'C57SL6jv7v', 'tGESaxcefT', 'oKLSnCcgqV', 'RDNSHgJAv4', 'psUSUxphYk'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, dHTFucwCCrkagJNH24.csHigh entropy of concatenated method names: 'iZaPqv6onw', 'o4EPikqcDk', 'tLwP3msrMx', 'RgEP2gnuOv', 'Mu6PJHQGr5', 'w1pPK4MgcT', 'fr3PXUgyah', 'S8TPWxBQ3x', 's9gPov7L7r', 'u86P9upIGS'
Source: 0.2.fLNzmBM9hR.exe.7b40000.7.raw.unpack, h8ZHejv5d21rwX7obe.csHigh entropy of concatenated method names: 'bcQleb9j0a', 'xpwl09E9dE', 'TiblRHSlU5', 'nkulkN7vwU', 'Q6mlfjFkvU', 'rRHld7v3xv', 'UO4lpo2F5L', 'y0kTjbfxcl', 'KYnTFuv2sc', 'PsoTC76ZN6'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, kneA8pFPEWPb7xDiGt.csHigh entropy of concatenated method names: 'LE0TkYUrhw', 'b92Tfis3WT', 'VRXTQbgweT', 'BYaTdJJ9gu', 'GjXTpdnJL5', 'MXRTPBk2RH', 'jW4TbfUINy', 'dJMTVjRgNj', 'agyT5btdTi', 'HbUTAxEQwC'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, VOWNRHQX9kUKKcoL7i.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fIbxClxsN7', 'THyxvmpG20', 'VFNxzur7lQ', 'aww0hZYeLT', 'oS20eLyA0N', 'HBP0xw6vKQ', 'b6W00vEOiD', 'sWGUMe4nfyA636cqhHS'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KlQkb2r7oFN52Q2qZe.csHigh entropy of concatenated method names: 'ToString', 'pOHGUtVLhe', 'lfsG71ffJT', 'q2cGspZEPs', 'EYsGmSXcA4', 'elIGLekvNe', 'nMcGI0ts9K', 'WrJGaW3F4D', 'AtpGnkIkXe', 'c0iGwG3DZ1'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, H56QvGabV6fscrZUYr.csHigh entropy of concatenated method names: 'u2IPkIIqGp', 'DxEPQLk8Rb', 'eEiPpsj4gl', 'k9Spv1USls', 'RwLpzjC2QC', 'UXCPhQXIgG', 'zf0PesVyCg', 'trIPxiZKDY', 'BcWP0bFxlv', 'BKTPRdUmlr'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, nxmtI7gx39DWI5vnUl.csHigh entropy of concatenated method names: 'RRHpDC56aw', 'OYepf5XTPQ', 'EWnpdQ7jfQ', 'hytpPSXtSM', 'fdVpbG7vcS', 'P3vd806QDT', 'E5gdB3rDyM', 'HlndjqoKVv', 'SXFdFSJxn2', 'FpRdCaZ1fm'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, SNZRMVe0WdymfJlynVe.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'r6NY4JEuY5', 'r0GYO8dkcQ', 'RICYraP9rt', 'fjWYZaPhch', 'SUvY83U25D', 'OiEYBKTyYZ', 'DTNYjSsape'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, p8SIOJzyxjsivyojIV.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'cZZlSSTn6x', 'iFKlM5nK5i', 'jTilGMmKke', 'l9ylyUDsue', 'sQ4lTSATjr', 'j2kll2hiJ4', 'zgOlYGmjim'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, oqdAOl97dxk3nqr3cY.csHigh entropy of concatenated method names: 'P7wdJRtQt2', 'BbldXXb4Uy', 'ioEQseG7Rs', 'iXmQmC5uGU', 'OAOQLQCCbp', 'RlRQI9vHfx', 'RsWQaDjYaM', 'EOZQnax6pc', 'RQVQwBLgmF', 'do9QH8eIEi'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, Vv1F3Ifw1mbQLiAjti.csHigh entropy of concatenated method names: 'Dispose', 'waVeCIQUdd', 'Prwx7jOsZO', 'kGbyyp7xZI', 'ibneveA8pP', 'tWPezb7xDi', 'ProcessDialogKey', 'ptRxhTafJC', 'zlRxeLvdPD', 'hEfxxQ8ZHe'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, sPwtxoehqmVp9W195LG.csHigh entropy of concatenated method names: 'nlVlq1dtAl', 'SJMli81HCy', 'mFul353nYy', 'fC7l2AF6WO', 'DJglJies54', 'sRJlKiYgG4', 'vaklXy7dmn', 'K6BlWtejXF', 'n3vloUJn24', 'FAjl9T1Q2S'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, Kc4J6S4Iblnb55We4o.csHigh entropy of concatenated method names: 'vyJMHEXSp7', 'wCgMud8ppU', 'orUM47KOrI', 'CnZMOGug4j', 'cQmM7in6EY', 'h52Mshe95x', 'TJbMmdCK3w', 'mtaMLmLHx0', 'qIXMIZZI40', 'zHBMabLnbH'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, dDlMY8RqgfYN8K0INW.csHigh entropy of concatenated method names: 'QenePt0Imf', 'ANMebZoNJ1', 'Pg0e5KJQWa', 'QJYeAJSqdA', 'xr3eMcYAxm', 'vI7eGx39DW', 'gxNZpHf5wSm3ka96Wl', 'keRQ6qtLOa93XpaTu0', 'AEMeeRtPkv', 'tfHe0D8rkQ'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, dTafJCC3lRLvdPDdEf.csHigh entropy of concatenated method names: 'jdxTgPRLiq', 'AWUT7UrRCx', 'cHxTsrjXQS', 'cr8TmuOYke', 'wnwT4Q2yun', 'pYCTLB4NRR', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, KG7cbGbyJ7qmmE4UuJ.csHigh entropy of concatenated method names: 'ff90DkIOna', 'SaY0k8sjTV', 'oYf0f44rtA', 'khU0Q4q728', 'Kfm0dWpd4R', 'acX0pUJ6KN', 'QyK0PRBM6J', 'B680bhmkNC', 'Hlb0VyLJjD', 'hOt05P6tG4'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, OmbQxuxUcHKEMN2xZL.csHigh entropy of concatenated method names: 'c8Z3nD5wy', 'dKV2D91eu', 'uR7KfpQNw', 'bpUX5QXBJ', 'PeJoPvF7h', 'UGB9rjwuK', 'Qa22cJuJnWtC7gYR1V', 'fgBjRt2TIxCNAanFdO', 'VMrT4vpaL', 'tJoY6PXJi'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, hjHIYLB4SSpneZSvS0.csHigh entropy of concatenated method names: 'f8fyF9Gdi0', 'MaYyv4dM3T', 'NvFThNEkLm', 'GydTeKymv7', 'dDwyUqEerM', 'ghXyuOcqjb', 'TbqycZN1vm', 'l30y4CW03L', 'bamyOHiYMn', 'vU3yrOkxZL'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, x1Cfjuog0KJQWacJYJ.csHigh entropy of concatenated method names: 'UPaQ2PeUcM', 'jdcQKMtRxa', 'xMGQW9TDoi', 'Ga6Qo1lQRv', 'XODQMNa5Qq', 'flqQGEYVcJ', 'J60Qy80Y1g', 'eDUQTYBT0q', 'tQWQlU6Zg0', 'NQrQYf0Men'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, FPrNA1Z02HXpGH8rCh.csHigh entropy of concatenated method names: 'xiOy5R0ao2', 'q46yABaDjF', 'ToString', 'pPDyk6YqCc', 'f0AyfOSs8s', 'Y2VyQQEahy', 'AjmydRhqP8', 'E5Eyp9p2AE', 'DcJyPWkyX7', 'z4HybRHxxh'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, Mt0ImfW2NMZoNJ1Hiu.csHigh entropy of concatenated method names: 'QDif46Drsu', 'MmwfOTiPA0', 'QfHfrK5QrX', 'vE5fZ9l56w', 'JVuf8yUwsV', 'AxbfBx0TSa', 'ROXfjGZP7H', 'tXffF792Sf', 'uMefCqcGaD', 'XmFfvYoIBW'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, RlrJ8Bc659FMOLPpT3.csHigh entropy of concatenated method names: 'mJBSWdbYLI', 'o5USoi1ml2', 'GiqSgjmvsF', 'UTqS7owb9m', 'LyOSmWWxJG', 'C57SL6jv7v', 'tGESaxcefT', 'oKLSnCcgqV', 'RDNSHgJAv4', 'psUSUxphYk'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, dHTFucwCCrkagJNH24.csHigh entropy of concatenated method names: 'iZaPqv6onw', 'o4EPikqcDk', 'tLwP3msrMx', 'RgEP2gnuOv', 'Mu6PJHQGr5', 'w1pPK4MgcT', 'fr3PXUgyah', 'S8TPWxBQ3x', 's9gPov7L7r', 'u86P9upIGS'
Source: 0.2.fLNzmBM9hR.exe.3dc5040.2.raw.unpack, h8ZHejv5d21rwX7obe.csHigh entropy of concatenated method names: 'bcQleb9j0a', 'xpwl09E9dE', 'TiblRHSlU5', 'nkulkN7vwU', 'Q6mlfjFkvU', 'rRHld7v3xv', 'UO4lpo2F5L', 'y0kTjbfxcl', 'KYnTFuv2sc', 'PsoTC76ZN6'
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeFile created: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile created: C:\Program Files (x86)\DNS Host\dnshost.exeJump to dropped file

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run DNS HostJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run DNS HostJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe:Zone.Identifier read attributes | deleteJump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DNS Host\dnshost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Yara detected AntiVM3
Source: Yara matchFile source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTR
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: D40000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 2A00000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 4A00000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 7BC0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 8BC0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 8E80000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: 9E80000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 1790000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 3240000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 2FB0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: ED0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: 2A80000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: F40000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: 75C0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: 85C0000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: 8860000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: 9860000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 14E0000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 2F00000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeMemory allocated: 2D20000 memory reserve | memory write watchJump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeMemory allocated: E50000 memory reserve | memory write watch
Source: C:\Program Files (x86)\DNS Host\dnshost.exeMemory allocated: 2BB0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\DNS Host\dnshost.exeMemory allocated: 28F0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7561Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2157Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: threadDelayed 4591Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: threadDelayed 5195Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: foregroundWindowGot 653Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWindow / User API: foregroundWindowGot 894Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exe TID: 6604Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6320Thread sleep time: -7378697629483816s >= -30000sJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 3684Thread sleep time: -27670116110564310s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe TID: 2640Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7320Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exe TID: 7580Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeThread delayed: delay time: 922337203685477
Source: Amcache.hve.20.drBinary or memory string: VMware
Source: Amcache.hve.20.drBinary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.20.drBinary or memory string: vmci.syshbin
Source: Amcache.hve.20.drBinary or memory string: VMware, Inc.
Source: Amcache.hve.20.drBinary or memory string: VMware20,1hbin@
Source: Amcache.hve.20.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.20.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.20.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.20.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000006.00000002.3093865655.0000000006860000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: Amcache.hve.20.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.20.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.20.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.20.drBinary or memory string: vmci.sys
Source: Amcache.hve.20.drBinary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: dgKDUvhlvCiVpa.exe, 00000007.00000002.1693658054.0000000000CD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.20.drBinary or memory string: vmci.syshbin`
Source: Amcache.hve.20.drBinary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.20.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.20.drBinary or memory string: VMware20,1
Source: Amcache.hve.20.drBinary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.20.drBinary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.20.drBinary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.20.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.20.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.20.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.20.drBinary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.20.drBinary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.20.drBinary or memory string: VMware Virtual RAM
Source: Amcache.hve.20.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.20.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and writeJump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5AJump to behavior
Writes to foreign memory regions
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 420000Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 422000Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D08008Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp"Jump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp"Jump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q\I
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^ql(z
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q@
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000034D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qT.M
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q<H=
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003618000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000034D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qD
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000034D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qH
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qP-
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q0
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q`'C
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q8}{
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^ql*[
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q`
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qd
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q,=@
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000035FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q`s~
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qL
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qP
Source: MSBuild.exe, 00000006.00000002.3097430254.0000000007B7D000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program ManagerManager
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q0jX
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003612000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$(a
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q#C
Source: MSBuild.exe, 00000006.00000002.3095776311.000000000770D000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Managerh
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qt
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000036A5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4fj
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q|
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000385A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.000000000384E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3093806559.000000000685C000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qlUH
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q 2E
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q@^H
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^ql
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q,f~
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qt
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qx
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q0JU
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q438
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000385A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager4V
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000034F4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.000000000373A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q(
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qP)E
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000034F4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerlB^q
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.00000000034D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager8
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003554000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^qlU[
Source: MSBuild.exe, 00000006.00000002.3081321042.000000000377E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q4w
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLR^q$H@
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Users\user\Desktop\fLNzmBM9hR.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeQueries volume information: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
Source: C:\Program Files (x86)\DNS Host\dnshost.exeQueries volume information: C:\Program Files (x86)\DNS Host\dnshost.exe VolumeInformation
Source: C:\Program Files (x86)\DNS Host\dnshost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation
Source: C:\Program Files (x86)\DNS Host\dnshost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 6_2_077D59F8 GetSystemTimes,6_2_077D59F8
Source: C:\Users\user\Desktop\fLNzmBM9hR.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: Amcache.hve.20.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.20.drBinary or memory string: msmpeng.exe
Source: Amcache.hve.20.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.20.drBinary or memory string: MsMpEng.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information

barindex
Yara detected Nanocore RAT
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTR

Remote Access Functionality

barindex
Detected Nanocore Rat
Source: fLNzmBM9hR.exe, 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: MSBuild.exe, 00000006.00000002.3087398590.0000000004543000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: MSBuild.exe, 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: MSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
Source: MSBuild.exe, 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
Source: MSBuild.exe, 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: MSBuild.exe, 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: MSBuild.exe, 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce
Source: MSBuild.exe, 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: MSBuild.exe, 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: dgKDUvhlvCiVpa.exe, 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: MSBuild.exe, 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Yara detected Nanocore RAT
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4b186.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a94629.12.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f4ffbc.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.3f545e5.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 6.2.MSBuild.exe.6a90000.13.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3de3638.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d2fb08.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 7.2.dgKDUvhlvCiVpa.exe.3db0c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.fLNzmBM9hR.exe.3d62528.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: fLNzmBM9hR.exe PID: 6540, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7012, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: dgKDUvhlvCiVpa.exe PID: 6960, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 7292, type: MEMORYSTR

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		11
Disable or Modify Tools		11
Input Capture		1
System Time Discovery		Remote Services11
Archive Collected Data		12
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Scheduled Task/Job		1
Scheduled Task/Job		312
Process Injection		1
Deobfuscate/Decode Files or Information		LSASS Memory1
File and Directory Discovery		Remote Desktop Protocol11
Input Capture		1
Non-Standard Port		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		3
Obfuscated Files or Information		Security Account Manager13
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Remote Access Software		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Registry Run Keys / Startup Folder		12
Software Packing		NTDS121
Security Software Discovery		Distributed Component Object ModelInput Capture1
Non-Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA Secrets2
Process Discovery		SSHKeylogging12
Application Layer Protocol		Scheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
Masquerading		Cached Domain Credentials31
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job312
Process Injection		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Hidden Files and Directories		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446518 Sample: fLNzmBM9hR.exe Startdate: 23/05/2024 Architecture: WINDOWS Score: 100 56 Snort IDS alert for network traffic 2->56 58 Multi AV Scanner detection for domain / URL 2->58 60 Found malware configuration 2->60 62 13 other signatures 2->62 7 fLNzmBM9hR.exe 7 2->7         started        11 dgKDUvhlvCiVpa.exe 5 2->11         started        13 dnshost.exe 2->13         started        process3 file4 44 C:\Users\user\AppData\...\dgKDUvhlvCiVpa.exe, PE32 7->44 dropped 46 C:\Users\user\AppData\Local\...\tmp7751.tmp, XML 7->46 dropped 64 Detected Nanocore Rat 7->64 66 Uses schtasks.exe or at.exe to add and modify task schedules 7->66 68 Adds a directory exclusion to Windows Defender 7->68 15 MSBuild.exe 1 10 7->15         started        20 powershell.exe 23 7->20         started        22 schtasks.exe 1 7->22         started        70 Antivirus detection for dropped file 11->70 72 Multi AV Scanner detection for dropped file 11->72 74 Machine Learning detection for dropped file 11->74 76 3 other signatures 11->76 24 MSBuild.exe 3 11->24         started        26 schtasks.exe 1 11->26         started        28 conhost.exe 13->28         started        signatures5 process6 dnsIp7 48 newsddawork.3utilities.com 104.243.242.165, 1620, 49732, 49736 VOXILITYGB United States 15->48 40 C:\Users\user\AppData\Roaming\...\run.dat, ISO-8859 15->40 dropped 42 C:\Program Files (x86)\DNS Host\dnshost.exe, PE32 15->42 dropped 50 Detected Nanocore Rat 15->50 52 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->52 30 WerFault.exe 15->30         started        54 Loading BitLocker PowerShell Module 20->54 32 WmiPrvSE.exe 20->32         started        34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 26->38         started        file8 signatures9 process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
fLNzmBM9hR.exe75%VirustotalBrowse
fLNzmBM9hR.exe76%ReversingLabsByteCode-MSIL.Trojan.LokiBot
fLNzmBM9hR.exe100%AviraTR/AD.Nanocore.ihehd
fLNzmBM9hR.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe100%AviraTR/AD.Nanocore.ihehd
C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe100%Joe Sandbox ML
C:\Program Files (x86)\DNS Host\dnshost.exe0%ReversingLabs
C:\Program Files (x86)\DNS Host\dnshost.exe1%VirustotalBrowse
C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe76%ReversingLabsByteCode-MSIL.Trojan.LokiBot
C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe75%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
fp2e7a.wpc.phicdn.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://www.apache.org/licenses/LICENSE-2.00%URL Reputationsafe
http://www.fontbureau.com0%URL Reputationsafe
http://www.fontbureau.com/designersG0%URL Reputationsafe
http://www.fontbureau.com/designers/?0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.fontbureau.com/designers?0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://upx.sf.net0%URL Reputationsafe
http://www.fontbureau.com/designers0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.carterandcone.coml0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.fontbureau.com/designers/cabarga.htmlN0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
http://www.fontbureau.com/designers/frere-user.html0%URL Reputationsafe
http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
http://www.fontbureau.com/designers80%URL Reputationsafe
http://www.fonts.com0%URL Reputationsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://www.urwpp.deDPlease0%URL Reputationsafe
http://www.zhongyicts.com.cn0%URL Reputationsafe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
http://www.sakkal.com0%URL Reputationsafe
maxlogs.webhop.me100%Avira URL Cloudmalware
http://google.com0%Avira URL Cloudsafe
http://www.monotype.0%Avira URL Cloudsafe
newsddawork.3utilities.com0%Avira URL Cloudsafe
http://google.com1%VirustotalBrowse
maxlogs.webhop.me12%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
newsddawork.3utilities.com
104.243.242.165
truetrue
    		unknown
    fp2e7a.wpc.phicdn.net
    		192.229.221.95
    		truefalseunknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    maxlogs.webhop.metrue
    • 12%, Virustotal, Browse
    • Avira URL Cloud: malware
    		unknown
    newsddawork.3utilities.comtrue
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.apache.org/licenses/LICENSE-2.0fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.comfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designersGfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designers/?fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.founder.com.cn/cn/bThefLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designers?fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.tiro.comfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://upx.sf.netAmcache.hve.20.drfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designersfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.goodfont.co.krfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://google.comMSBuild.exe, 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmpfalse
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		unknown
    http://www.carterandcone.comlfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.sajatypeworks.comfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.typography.netDfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designers/cabarga.htmlNfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.founder.com.cn/cn/cThefLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.galapagosdesign.com/staff/dennis.htmfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmp, fLNzmBM9hR.exe, 00000000.00000002.1676472894.0000000005FAB000.00000004.00000020.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.founder.com.cn/cnfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designers/frere-user.htmlfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.monotype.fLNzmBM9hR.exe, 00000000.00000002.1676427170.0000000005F70000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.jiyu-kobo.co.jp/fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    • URL Reputation: safe
    		unknown
    http://www.galapagosdesign.com/DPleasefLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fontbureau.com/designers8fLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.fonts.comfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.sandoll.co.krfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.urwpp.deDPleasefLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.zhongyicts.com.cnfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namefLNzmBM9hR.exe, 00000000.00000002.1673750956.0000000002A76000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, dgKDUvhlvCiVpa.exe, 00000007.00000002.1695292378.0000000002B42000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    http://www.sakkal.comfLNzmBM9hR.exe, 00000000.00000002.1676512843.0000000007082000.00000004.00000800.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    104.243.242.165
    		newsddawork.3utilities.comUnited States
    		3223VOXILITYGBtrue

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1446518
    Start date and time:2024-05-23 15:46:06 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 10m 10s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:22
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:fLNzmBM9hR.exe
    renamed because original name is a hash value
    Original Sample Name:14239732dbddfe922c297fdeac56a062.exe
    Detection:MAL
    Classification:mal100.troj.evad.winEXE@19/23@16/1
    EGA Information:
    • Successful, ratio: 80%
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 106
    • Number of non-executed functions: 7
    Cookbook Comments:
    • Found application associated with file extension: .exe
    • Override analysis time to 240000 for current running targets taking high CPU consumption

    Warnings

    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 2.19.244.127, 40.68.123.157, 93.184.221.240, 192.229.221.95, 13.95.31.18, 20.3.187.198, 40.126.32.140, 40.126.32.138, 40.126.32.136, 40.126.32.74, 20.190.160.14, 40.126.32.134, 20.190.160.20, 40.126.32.76, 20.42.65.92
    • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
    • Execution Graph export aborted for target dnshost.exe, PID 7492 because it is empty
    • Not all processes where analyzed, report is missing behavior information
    • Report size exceeded maximum capacity and may have missing behavior information.
    • Report size getting too big, too many NtCreateKey calls found.
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtProtectVirtualMemory calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • Report size getting too big, too many NtSetInformationFile calls found.

    Simulations

    Behavior and APIs

    TimeTypeDescription
    09:46:54API Interceptor1x Sleep call for process: fLNzmBM9hR.exe modified
    09:46:55API Interceptor13x Sleep call for process: powershell.exe modified
    09:46:56API Interceptor188792x Sleep call for process: MSBuild.exe modified
    09:46:57API Interceptor1x Sleep call for process: dgKDUvhlvCiVpa.exe modified
    09:49:18API Interceptor1x Sleep call for process: WerFault.exe modified
    14:46:56Task SchedulerRun new task: dgKDUvhlvCiVpa path: C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
    14:47:00AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DNS Host C:\Program Files (x86)\DNS Host\dnshost.exe

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    fp2e7a.wpc.phicdn.nethttp://info.ipreo.com/Privacy-Policy.htmlGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    RFQ for PR-10453180.exeGet hashmaliciousAgentTeslaBrowse
    • 192.229.221.95
    http://chocolatefashiononline.comGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://lnk.sk/mzoyGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://lnk.sk/twr3Get hashmaliciousUnknownBrowse
    • 192.229.221.95
    Agent_Install.exeGet hashmaliciousJupyterBrowse
    • 192.229.221.95
    Agent_Install.exeGet hashmaliciousJupyterBrowse
    • 192.229.221.95
    https://url.uk.m.mimecastprotect.com/s/pk4ACO8rYSq23vcE1w2JGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://url2.mailanyone.net/scanner?m=1s75OW-00H93j-3q&d=4%7Cmail/90/1715743800/1s75OW-00H93j-3q%7Cin2g%7C57e1b682%7C28613012%7C14303582%7C66442D0C9DE45F67A799D66BCFD1EFF8&o=4pht8//7t:b4gbocxl8..rvkoruce.m&s=Jbo_JSeAXF_5NoSAMdVs1uNtYbwGet hashmaliciousUnknownBrowse
    • 192.229.221.95
    https://g84qffhbb.cc.rs6.net/tn.jsp?f=001vOSSOENWSS4200uPNQEHjSDew4NbMuiPEfXAZZvLVpSmWUMPp8xPA1aAMxaun3grFaJ03lpVQAq0CnwEItgBCJ96l3XkhNonHD4qdyLoQ9nfNBhndHEDOsc5Zhc0NCidtDQvd1XijlCuZzhEm_iedfFzIAxsfdBF&c=&ch=Get hashmaliciousUnknownBrowse
    • 192.229.221.95

    ASNs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    VOXILITYGBmsimg32.dllGet hashmaliciousRemcosBrowse
    • 104.243.242.199
    DHL_Shipping_Invoice00000_pdf.exeGet hashmaliciousRemcosBrowse
    • 172.94.9.229
    z7DHL_AWB_Shipping0000000.vbsGet hashmaliciousRemcosBrowse
    • 172.94.9.229
    z93DHL_AWB_Shipping0000000.vbsGet hashmaliciousRemcosBrowse
    • 172.94.9.229
    PURCHASEORDERSHEET&SPECIFICATIONSDOC.exeGet hashmaliciousGuLoader, RemcosBrowse
    • 172.94.9.228
    uvaXiyELu9.elfGet hashmaliciousMiraiBrowse
    • 104.250.189.207
    https://operationalservice.com.bas-korae.com/w?cms=joerg.donner@daiichi-sankyo.deGet hashmaliciousHTMLPhisherBrowse
    • 185.171.187.163
    https://microsoftonlineservice.com.general-meel.xyz/w?cms=mr.been@uk.comGet hashmaliciousHTMLPhisherBrowse
    • 185.171.187.163
    bTf3.exeGet hashmaliciousAsyncRAT, VenomRATBrowse
    • 172.111.139.95
    bTkg.exeGet hashmaliciousAsyncRAT, VenomRATBrowse
    • 172.111.139.95

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    C:\Program Files (x86)\DNS Host\dnshost.exehesaphareketi_1.exeGet hashmaliciousAgentTeslaBrowse
      Dhl-SHIPPING DOCUMENTS_PDF.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
        INV_#501424.vbsGet hashmaliciousXWormBrowse
          detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.vbsGet hashmaliciousAgentTeslaBrowse
            COMPANY PROFILE_pdf.exeGet hashmaliciousAgentTeslaBrowse
              hesaphareketi-01.bat.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                Payment Reciept.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                  SOA.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                    SecuriteInfo.com.Win64.TrojanX-gen.5091.20328.exeGet hashmaliciousQuasarBrowse
                      SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exeGet hashmaliciousClipboard Hijacker, XWorm, XmrigBrowse

                        Created / dropped Files

                        C:\Program Files (x86)\DNS Host\dnshost.exe

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                        Category:dropped
                        Size (bytes):262432
                        Entropy (8bit):6.179415524830389
                        Encrypted:false
                        SSDEEP:3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
                        MD5:8FDF47E0FF70C40ED3A17014AEEA4232
                        SHA1:E6256A0159688F0560B015DA4D967F41CBF8C9BD
                        SHA-256:ED9884BAC608C06B7057037CC91D90E4AE5F74DD2DBCE2AF476699C6D4492D82
                        SHA-512:BD69D092ED4F9C5E1F24EAF5EC79FB316469D53849DC798FAE0FCBA5E90869B77EE924C23CC6F692198FF25827AB60AD47BB46CADD6E0AADDE7731CBAFB013BE
                        Malicious:false
                        Antivirus:
                        • Antivirus: ReversingLabs, Detection: 0%
                        • Antivirus: Virustotal, Detection: 1%, Browse
                        Joe Sandbox View:
                        • Filename: hesaphareketi_1.exe, Detection: malicious, Browse
                        • Filename: Dhl-SHIPPING DOCUMENTS_PDF.exe, Detection: malicious, Browse
                        • Filename: INV_#501424.vbs, Detection: malicious, Browse
                        • Filename: detalle_transferencia_2024-05-13T064143.173 0200_3049280002017526_PDF.vbs, Detection: malicious, Browse
                        • Filename: COMPANY PROFILE_pdf.exe, Detection: malicious, Browse
                        • Filename: hesaphareketi-01.bat.exe, Detection: malicious, Browse
                        • Filename: Payment Reciept.exe, Detection: malicious, Browse
                        • Filename: SOA.exe, Detection: malicious, Browse
                        • Filename: SecuriteInfo.com.Win64.TrojanX-gen.5091.20328.exe, Detection: malicious, Browse
                        • Filename: SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe, Detection: malicious, Browse
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.].........."...0..|...B......:.... ........@.. ...............................L....`....................................O........>.............. A........................................................... ............... ..H............text...Xz... ...|.................. ..`.rsrc....>.......@...~..............@..@.reloc..............................@..B........................H........)...................|..........................................*.{.......*v.(=....r...p({...-..+..}....*....0..%........(....-..*....(z.....&..}.........*.*....................0..5........(....-..*.-.r+..ps>...z.....i(z.....&..}.........*.*............%......>....(?...(....*N..(@....oA...(....*:...(B...(....*:...(C...(....**....(....*....0..G........(....,..*..(....-...}.....*.r...p(x...&.(v.....}......&..}.........*.*..........7.......0..f........-.r7..ps>...z .....

                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_f553dd681214908324f05d7ad9ebff8e6dc2a494_1623435c_b407573d-7935-418a-89b8-f36dbc0c1682\Report.wer

                        Download File
                        Process:C:\Windows\SysWOW64\WerFault.exe
                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):65536
                        Entropy (8bit):1.223796834425182
                        Encrypted:false
                        SSDEEP:192:/ZtcOWM0MLLHzK1a60+mZjWFzuiFrZ24IO8q+:hFWHMHHu1aTjWFzuiFrY4IO8q+
                        MD5:357C0CCE0D3985AA2727954EE45108F7
                        SHA1:D026A0FE987268A96D2A5A7B4C187DB835A3633A
                        SHA-256:EC831972621875F642E43FB578DF5E8A97C055EB38AD9FA4756B5D28491BC1A5
                        SHA-512:F12188F1802143870F4D4657C27929BC328143DB26697566132E82336D6ACA279E1286BB4312E0D459A22642A7FCF811A0CDB8C44C47935E8278F1CEC7A9554C
                        Malicious:false
                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.0.9.4.5.7.1.1.0.5.1.6.6.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.0.9.4.5.7.4.4.6.7.6.6.7.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.0.7.5.7.3.d.-.7.9.3.5.-.4.1.8.a.-.8.9.b.8.-.f.3.6.d.b.c.0.c.1.6.8.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.8.7.8.7.a.6.-.d.1.d.5.-.4.a.8.d.-.8.0.c.7.-.7.7.7.1.9.6.0.8.b.1.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.6.4.-.0.0.0.1.-.0.0.1.4.-.c.2.5.5.-.d.8.a.c.1.7.a.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

                        C:\ProgramData\Microsoft\Windows\WER\Temp\WER4924.tmp.WERInternalMetadata.xml

                        Download File
                        Process:C:\Windows\SysWOW64\WerFault.exe
                        File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):6312
                        Entropy (8bit):3.72165219692252
                        Encrypted:false
                        SSDEEP:192:R6l7wVeJFJ6eKqpYaJLMeKDpDT89bp+sfeDm:R6lXJr6gYaJLUip9f7
                        MD5:EEEB85974DBBC23CCE93DD4EBFA89487
                        SHA1:96CB96E8648F1248533F19A6D4909B5BABC8EF27
                        SHA-256:EF5F4F79E7B2B7A2082856BD8D2E0508778A92ADD6B0CBDBE0C3EB2C37A29B5E
                        SHA-512:F3070DB2731B8BFB31554312AD3CB858FD9ECAF44E06E6ADB6179DF08FA8909489C3F1F039B559405D6489AEAF1D3286E2C3121CD3FA1B1A752800F35B8051D3
                        Malicious:false
                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.1.2.<./.P.i.

                        C:\ProgramData\Microsoft\Windows\WER\Temp\WER4963.tmp.xml

                        Download File
                        Process:C:\Windows\SysWOW64\WerFault.exe
                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):4642
                        Entropy (8bit):4.457652867901404
                        Encrypted:false
                        SSDEEP:48:cvIwWl8zs3Jg77aI9v0WpW8VYwYm8M4JL9HNkFtN+q8K9H368mLZd:uIjfZI75t7VYJhHUZHq8mLZd
                        MD5:1F916E307E706C9B0C94258BCBECD419
                        SHA1:121B704EAD94560A642B46937982371BEBA50891
                        SHA-256:E006E0E05393ECA17C28711A9F49A9D9BA6F16479668399FC7F6719A413EF627
                        SHA-512:E082CC4740D6FC1A4117074C4A7F086B1E4B8140476AF088BD5D8588E8E13BF738C5EF2A1C33E5180FCC30E3FA92EDA03D0D1A48B521F8F2FD2200FB063C10E4
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="335811" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6F3.tmp.dmp

                        Download File
                        Process:C:\Windows\SysWOW64\WerFault.exe
                        File Type:Mini DuMP crash report, 15 streams, Thu May 23 13:49:04 2024, 0x1205a4 type
                        Category:dropped
                        Size (bytes):1476983
                        Entropy (8bit):4.74087256417849
                        Encrypted:false
                        SSDEEP:12288:ALK+E8ujJieh500XQ26z7roQvyDX9lx3TzqZdDoS:ALK+JjU2DVyjjlqZJoS
                        MD5:4B2736E6A5D8F991649778399B3CE3F7
                        SHA1:F5C0941BF1560D0AA725417F47AF793AAA475418
                        SHA-256:E099A0036952B01300922613A243CEB751E78699BC9EE2486141EB1843DC4126
                        SHA-512:E8CBAC1B9F406887DDDAFBA30DE4762902C831865C65AC69B2D595696F47B7D467D5316A3C5A7F55437B12CE9966B430ECD46F837FC6F7CA094C6BC613132E7C
                        Malicious:false
                        Preview:MDMP..a..... .......PIOf......................... ..........$....+.......;...r..........`.......8...........T...........pO...:...........+...........-..............................................................................eJ......l.......GenuineIntel............T.......d....HOf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):1216
                        Entropy (8bit):5.34331486778365
                        Encrypted:false
                        SSDEEP:24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzea
                        MD5:7B709BC412BEC5C3CFD861C041DAD408
                        SHA1:532EA6BB3018AE3B51E7A5788F614A6C49252BCF
                        SHA-256:733765A1599E02C53826A4AE984426862AA714D8B67F889607153888D40BBD75
                        SHA-512:B35CFE36A1A40123FDC8A5E7C804096FF33F070F40CBA5812B98F46857F30BA2CE6F86E1B5D20F9B6D00D6A8194B8FA36C27A0208C7886512877058872277963
                        Malicious:false
                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dgKDUvhlvCiVpa.exe.log

                        Download File
                        Process:C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):1216
                        Entropy (8bit):5.34331486778365
                        Encrypted:false
                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                        Malicious:false
                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dnshost.exe.log

                        Download File
                        Process:C:\Program Files (x86)\DNS Host\dnshost.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:modified
                        Size (bytes):1037
                        Entropy (8bit):5.3594460201342535
                        Encrypted:false
                        SSDEEP:24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzervEE4xDqE4j:MxHKlYHKh3oPtHo6hAHKzervEHxDqHj
                        MD5:DC4D693606B39967E81E3ED651DE35B3
                        SHA1:F4E6ECCB66D4D9B66E726C6BBC089A704D25A707
                        SHA-256:54E5F36B1A3F58D73B9AC2BCCFC976FE015A3772D584204FE4B2C47F77A61299
                        SHA-512:5C6ADD09870F5A41302A4B70C3976BD2D1E8A9C8ED0D76AE7323D9A424DE3B6255ED30CF927103A59949F883833D4AC33381E7F7039729B686DE2E86B1013B17
                        Malicious:false
                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build, Version=4.0.0.0, Culture=neutral,

                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fLNzmBM9hR.exe.log

                        Download File
                        Process:C:\Users\user\Desktop\fLNzmBM9hR.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):1216
                        Entropy (8bit):5.34331486778365
                        Encrypted:false
                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                        Malicious:false
                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                        Download File
                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):2232
                        Entropy (8bit):5.379552885213346
                        Encrypted:false
                        SSDEEP:48:fWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//8M0Uyus:fLHxvCsIfA2KRHmOugw1s
                        MD5:08C4BB62AB814866FFEF46F746CB9140
                        SHA1:A24D7CCEC57571B1ADD96212CC8EB391982964E9
                        SHA-256:BBF508C20A76CD57ADC1E12C9239C6A82F72BC034F3B01AF7F8C3FED34FE0A6B
                        SHA-512:B69AA0C4455E7074715844071FE40CC5B4069D8D54AE37AC37762282AEEBEA04A2C3C3385B29ACB11FC8DA6A17D3C4F81BF6DF9AD3AEA3A7EC29255B7CE3D231
                        Malicious:false
                        Preview:@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bxf515li.ghq.ps1

                        Download File
                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        File Type:ASCII text, with no line terminators
                        Category:dropped
                        Size (bytes):60
                        Entropy (8bit):4.038920595031593
                        Encrypted:false
                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                        Malicious:false
                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hz5jt5ps.pz5.psm1

                        Download File
                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        File Type:ASCII text, with no line terminators
                        Category:dropped
                        Size (bytes):60
                        Entropy (8bit):4.038920595031593
                        Encrypted:false
                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                        Malicious:false
                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oiyaziqw.sfh.psm1

                        Download File
                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        File Type:ASCII text, with no line terminators
                        Category:dropped
                        Size (bytes):60
                        Entropy (8bit):4.038920595031593
                        Encrypted:false
                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                        Malicious:false
                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgufgmvk.ob1.ps1

                        Download File
                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        File Type:ASCII text, with no line terminators
                        Category:dropped
                        Size (bytes):60
                        Entropy (8bit):4.038920595031593
                        Encrypted:false
                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                        Malicious:false
                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                        C:\Users\user\AppData\Local\Temp\tmp7751.tmp

                        Download File
                        Process:C:\Users\user\Desktop\fLNzmBM9hR.exe
                        File Type:XML 1.0 document, ASCII text
                        Category:dropped
                        Size (bytes):1580
                        Entropy (8bit):5.117911636839531
                        Encrypted:false
                        SSDEEP:24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTMv
                        MD5:43661420A9E8C8A3450703867941B585
                        SHA1:D272D278848EC8D31F7BAE78428268F3EC223D9C
                        SHA-256:B2B73C7B3CF1319EF0EF74D5627725B5D3AFAF1AD09AC8C667DEE9454D152D14
                        SHA-512:0EF692B100A6E53026A807B32EC5AC56AD930E18C6EA38928A92E365D63712ACC371C073DAE0F7F7D2F0F7FF4D2CABEF0D7BD47E8E468526602914B08A432DE1
                        Malicious:true
                        Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

                        C:\Users\user\AppData\Local\Temp\tmp802A.tmp

                        Download File
                        Process:C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
                        File Type:XML 1.0 document, ASCII text
                        Category:dropped
                        Size (bytes):1580
                        Entropy (8bit):5.117911636839531
                        Encrypted:false
                        SSDEEP:24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaXxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTMv
                        MD5:43661420A9E8C8A3450703867941B585
                        SHA1:D272D278848EC8D31F7BAE78428268F3EC223D9C
                        SHA-256:B2B73C7B3CF1319EF0EF74D5627725B5D3AFAF1AD09AC8C667DEE9454D152D14
                        SHA-512:0EF692B100A6E53026A807B32EC5AC56AD930E18C6EA38928A92E365D63712ACC371C073DAE0F7F7D2F0F7FF4D2CABEF0D7BD47E8E468526602914B08A432DE1
                        Malicious:false
                        Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

                        C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\catalog.dat

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        File Type:data
                        Category:modified
                        Size (bytes):232
                        Entropy (8bit):7.089541637477408
                        Encrypted:false
                        SSDEEP:3:XrURGizD7cnRNGbgCFKRNX/pBK0jCV83ne+VdWPiKgmR7kkmefoeLBizbCuVkqYM:X4LDAnybgCFcps0OafmCYDlizZr/i/Oh
                        MD5:9E7D0351E4DF94A9B0BADCEB6A9DB963
                        SHA1:76C6A69B1C31CEA2014D1FD1E222A3DD1E433005
                        SHA-256:AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757
                        SHA-512:93CCF7E046A3C403ECF8BC4F1A8850BA0180FE18926C98B297C5214EB77BC212C8FBCC58412D0307840CF2715B63BE68BACDA95AA98E82835C5C53F17EF38511
                        Malicious:false
                        Preview:Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&

                        C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\run.dat

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        File Type:ISO-8859 text, with no line terminators
                        Category:dropped
                        Size (bytes):8
                        Entropy (8bit):3.0
                        Encrypted:false
                        SSDEEP:3:3Lezn:3qz
                        MD5:82EF622C4F77C9918DFD4E79A5B82611
                        SHA1:EF864B01B934E1D7D10D5E186346315CA58CED76
                        SHA-256:21C0096509897660A12ABC21DD3AF09D4F86B127A5AF581003EF586469EDB5C5
                        SHA-512:9A642DE1035FAD646BC504106FBC51F9E1683E6B6916B79822C0A9CEABBC31A77AE3670F9A3F86B24EC3B81F4EF9A0CB4D2B492CE7E92144B60EBF328968F3CF
                        Malicious:true
                        Preview:..t..{.H

                        C:\Users\user\AppData\Roaming\9E146BE9-C76A-4720-BCDB-53011B87BD06\storage.dat

                        Download File
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):327768
                        Entropy (8bit):7.999367066417797
                        Encrypted:true
                        SSDEEP:6144:oX44S90aTiB66x3PlZmqze1d1wI8lkWmtjJ/3Exi:LkjbU7LjGxi
                        MD5:2E52F446105FBF828E63CF808B721F9C
                        SHA1:5330E54F238F46DC04C1AC62B051DB4FCD7416FB
                        SHA-256:2F7479AA2661BD259747BC89106031C11B3A3F79F12190E7F19F5DF65B7C15C8
                        SHA-512:C08BA0E3315E2314ECBEF38722DF834C2CB8412446A9A310F41A8F83B4AC5984FCC1B26A1D8B0D58A730FDBDD885714854BDFD04DCDF7F582FC125F552D5C3CA
                        Malicious:false
                        Preview:pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.)*.....{B.[...y%.*..i.Q.<..xt.X..H.. ..HF7g...I.*3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^*I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.|i4...i...;O...n.?.,. ....v?.5}.OY@.dG|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`|.B....3.....I..o...u1..8i=.z.W..7

                        C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe

                        Download File
                        Process:C:\Users\user\Desktop\fLNzmBM9hR.exe
                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                        Category:dropped
                        Size (bytes):641536
                        Entropy (8bit):7.971308220324232
                        Encrypted:false
                        SSDEEP:12288:glYifTsdxUde52iuVHaARloUgtGuFxmwk2BUY0Yk/a7LG1N7DpA:PiYd5uVHaAlhgtfvBUYuqLG1JDW
                        MD5:14239732DBDDFE922C297FDEAC56A062
                        SHA1:3F4F6454C4A2C1C5D1E10D5F841CE14EEF00A785
                        SHA-256:1805439355F48464312B4F9C0E16301C5F211C204E197C2000E7342C8DB95C00
                        SHA-512:87125027FE82DF355F6461E540AFBEDC68372FF2B29EE1531D3C6F42144D993EE044B68488C8B0144CECD6C74CBD964F5445FEE19954167E2301FF19E9E3E628
                        Malicious:true
                        Antivirus:
                        • Antivirus: Avira, Detection: 100%
                        • Antivirus: Joe Sandbox ML, Detection: 100%
                        • Antivirus: ReversingLabs, Detection: 76%
                        • Antivirus: Virustotal, Detection: 75%, Browse
                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Kf..............0.................. ........@.. ....................... ............@.....................................O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......DF..`=......6........Q............................................r...p}.....r...p}.....(.....(.....(]...}....*fr!..prQ..p.@.re..p(....&*.r...p(....*2r...p.(....*.(....*....0..h........{....o`....+>.o....t......{....o..........%...%..oU....%..oY....=....o....&.o....-....u......,..o.....*........JV.......0...........{....o..... o........-.r...p(....&..+...1.r...p(....&...,..{....o....o....*.{....o....o.....o....o....t......-.r)..p(....&.{....o....o....*.{....o....o....

                        C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe:Zone.Identifier

                        Download File
                        Process:C:\Users\user\Desktop\fLNzmBM9hR.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):26
                        Entropy (8bit):3.95006375643621
                        Encrypted:false
                        SSDEEP:3:ggPYV:rPYV
                        MD5:187F488E27DB4AF347237FE461A079AD
                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                        Malicious:false
                        Preview:[ZoneTransfer]....ZoneId=0

                        C:\Windows\appcompat\Programs\Amcache.hve

                        Download File
                        Process:C:\Windows\SysWOW64\WerFault.exe
                        File Type:MS Windows registry file, NT/2000 or above
                        Category:dropped
                        Size (bytes):1835008
                        Entropy (8bit):4.466370557630878
                        Encrypted:false
                        SSDEEP:6144:tIXfpi67eLPU9skLmb0b4OWSPKaJG8nAgejZMMhA2gX4WABl0uNddwBCswSb+:+XD94OWlLZMM6YFH7++
                        MD5:EEE0F2BC29539EE63523989B8E12066E
                        SHA1:B035AC997F6FF907561C6CB74F28BBE0D11DC293
                        SHA-256:4655BFC11EFBC95EC36DD9D33722994D50B6E6BE02DC16D0486BC85E710579F3
                        SHA-512:E4E48F22DCCA8801FAA2577061D539D795DA8E6862D30D07C0A72616E5CC3777807168A4D8764AA75B17D1D39B869A4CEC7DA4D76A323B7581EFD1F79785394D
                        Malicious:false
                        Preview:regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmV,}...................................................................................................................................................................................................................................................................................................................................................k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        \Device\ConDrv

                        Download File
                        Process:C:\Program Files (x86)\DNS Host\dnshost.exe
                        File Type:ASCII text, with CRLF line terminators
                        Category:dropped
                        Size (bytes):298
                        Entropy (8bit):4.924206445966445
                        Encrypted:false
                        SSDEEP:6:zx3M1tFAbQtASR30qyMstwYVoRRZBXVN+J0fFdCsq2UTiMdH8stCal+n:zK13P30ZMt9BFN+QdCT2UftCM+
                        MD5:932782CF70ED00D22C0B08B5027B4E31
                        SHA1:78F460A2155D9E819B8452C281285D7E0A7AC14F
                        SHA-256:F2C2477FB3FD0A30F3D3D8637EF9C774B43E940043635DF90CDD804799A2ECE7
                        SHA-512:C83E72797C03CABCAB066B95BAEEBB13944143846794061CF9482EA3B283979E470930047FDAE72A6F06F51F3127FF39DAAEFAAD7557E3AD49F590B9E7B78D24
                        Malicious:false
                        Preview:Microsoft (R) Build Engine version 4.8.4084.0..[Microsoft .NET Framework, version 4.0.30319.42000]..Copyright (C) Microsoft Corporation. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

                        Static File Info

                        General

                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                        Entropy (8bit):7.971308220324232
                        TrID:
                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                        • Win32 Executable (generic) a (10002005/4) 49.78%
                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                        • Generic Win/DOS Executable (2004/3) 0.01%
                        • DOS Executable Generic (2002/1) 0.01%
                        File name:fLNzmBM9hR.exe
                        File size:641'536 bytes
                        MD5:14239732dbddfe922c297fdeac56a062
                        SHA1:3f4f6454c4a2c1c5d1e10d5f841ce14eef00a785
                        SHA256:1805439355f48464312b4f9c0e16301c5f211c204e197c2000e7342c8db95c00
                        SHA512:87125027fe82df355f6461e540afbedc68372ff2b29ee1531d3c6f42144d993ee044b68488c8b0144cecd6c74cbd964f5445fee19954167e2301ff19e9e3e628
                        SSDEEP:12288:glYifTsdxUde52iuVHaARloUgtGuFxmwk2BUY0Yk/a7LG1N7DpA:PiYd5uVHaAlhgtfvBUYuqLG1JDW
                        TLSH:32D423123B69C1FBCEAE66364003515927316C7A3C85EBCA0DD2A088CFF5F67726255B
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Kf..............0.................. ........@.. ....................... ............@................................

                        File Icon

                        Icon Hash:d4c0aa9a96d6aa80

                        Static PE Info

                        General

                        Entrypoint:0x49d50e
                        Entrypoint Section:.text
                        Digitally signed:false
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                        Time Stamp:0x664BF5A6 [Tue May 21 01:15:18 2024 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:4
                        OS Version Minor:0
                        File Version Major:4
                        File Version Minor:0
                        Subsystem Version Major:4
                        Subsystem Version Minor:0
                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                        Entrypoint Preview

                        Instruction
                        jmp dword ptr [00402000h]
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al
                        add byte ptr [eax], al

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0x9d4bc0x4f.text
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x9e0000xebc.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xa00000xc.reloc
                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x20000x9b5140x9b600f46d87e626b1be8230d06841606bb515False0.969926903157683data7.9781458639858265IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                        .rsrc0x9e0000xebc0x10008d018facc40c64a08fbd2da18c520755False0.684326171875data6.420705935291826IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .reloc0xa00000xc0x200b40622e1ba3fec8862511b8db1f35945False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountryZLIB Complexity
                        RT_ICON0x9e0c80xb84PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.8253052917232022
                        RT_GROUP_ICON0x9ec5c0x14data1.05
                        RT_VERSION0x9ec800x236data0.4876325088339223

                        Imports

                        DLLImport
                        mscoree.dll_CorExeMain

                        Network Behavior

                        Snort IDS Alerts

                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                        05/23/24-15:47:18.239422TCP2046914ET TROJAN NanoCore RAT CnC 7497441620192.168.2.4104.243.242.165
                        05/23/24-15:47:30.409016TCP2046914ET TROJAN NanoCore RAT CnC 7497461620192.168.2.4104.243.242.165
                        05/23/24-15:47:49.518159TCP2046914ET TROJAN NanoCore RAT CnC 7497491620192.168.2.4104.243.242.165
                        05/23/24-15:47:36.408636TCP2046914ET TROJAN NanoCore RAT CnC 7497471620192.168.2.4104.243.242.165
                        05/23/24-15:48:01.127491TCP2046914ET TROJAN NanoCore RAT CnC 7497521620192.168.2.4104.243.242.165
                        05/23/24-15:47:04.830476TCP2046914ET TROJAN NanoCore RAT CnC 7497361620192.168.2.4104.243.242.165
                        05/23/24-15:46:58.783649TCP2046914ET TROJAN NanoCore RAT CnC 7497321620192.168.2.4104.243.242.165
                        05/23/24-15:47:50.030323TCP2046917ET TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)162049749104.243.242.165192.168.2.4
                        05/23/24-15:47:29.411754TCP2816718ETPRO TROJAN NanoCore RAT Keep-Alive Beacon497461620192.168.2.4104.243.242.165
                        05/23/24-15:47:24.267940TCP2046914ET TROJAN NanoCore RAT CnC 7497451620192.168.2.4104.243.242.165
                        05/23/24-15:47:45.326170TCP2046909ET TROJAN NanoCore RAT Keepalive Response 1162049748104.243.242.165192.168.2.4
                        05/23/24-15:47:43.543709TCP2046914ET TROJAN NanoCore RAT CnC 7497481620192.168.2.4104.243.242.165
                        05/23/24-15:47:55.533842TCP2046914ET TROJAN NanoCore RAT CnC 7497511620192.168.2.4104.243.242.165
                        05/23/24-15:47:12.142968TCP2046914ET TROJAN NanoCore RAT CnC 7497371620192.168.2.4104.243.242.165

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        May 23, 2024 15:46:50.939971924 CEST49675443192.168.2.4173.222.162.32
                        May 23, 2024 15:46:56.903606892 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:56.908595085 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:56.908658981 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:56.914242983 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:56.959625006 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:57.768512011 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:57.773493052 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:57.832843065 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:57.834352970 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:57.839268923 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.361650944 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.369055033 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.374130011 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.744425058 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.745539904 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.745610952 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.748265982 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.750996113 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.751007080 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.751045942 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.756462097 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.756513119 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.759226084 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.759237051 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.759279013 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.764681101 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.766556978 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.766567945 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.766618967 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.783648968 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.815447092 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.815527916 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.820601940 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.971704006 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.972706079 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.972862005 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.975020885 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.975030899 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.975080013 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.979667902 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.979680061 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.979732990 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.985949039 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.985959053 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.986167908 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.988961935 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.988970995 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.988979101 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.989027023 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.992667913 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.992676973 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.992723942 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.995982885 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.995995045 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.996002913 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.996035099 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.996068001 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:58.999279022 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.999289036 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.999296904 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:58.999345064 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.002573013 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.002583981 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.002590895 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.002615929 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.002646923 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.198431015 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.200050116 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.200062037 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.200120926 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.200946093 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.201005936 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.202755928 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.202790976 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.202843904 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.204437971 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.204472065 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.204524040 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.207850933 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.207866907 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.207879066 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.207920074 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.211270094 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.211323977 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.212656975 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.212667942 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.212677002 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.212708950 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.215445995 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.215457916 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.215493917 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.218193054 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.218204021 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.218241930 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.221021891 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.221034050 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.221041918 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.221066952 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.221096992 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.223695993 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.223706961 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.223750114 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.225971937 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.225984097 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.226027012 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.228297949 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.228308916 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.228351116 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.230489969 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.230500937 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.230509043 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.230541945 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.232724905 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.232734919 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.232770920 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.234970093 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.234981060 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.235021114 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.237304926 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.237338066 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.237365007 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.239453077 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.239485025 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.239516020 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.241476059 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.241509914 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.241538048 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.241540909 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.241594076 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.290843010 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.343672037 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.343831062 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.428143024 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.428656101 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.428833961 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.429689884 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.429701090 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.429774046 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.432128906 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.432140112 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.432276964 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.434098005 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.434108973 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.434117079 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.434237003 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.436347008 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.436357975 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.436420918 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.438560963 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.438575983 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.438709974 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.440287113 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.440298080 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.440361023 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.442051888 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.442063093 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.442071915 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.442133904 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.442133904 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.443787098 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.443798065 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.443857908 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.445604086 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.445615053 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.445713043 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.447354078 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.447365046 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.447413921 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.449522018 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.449554920 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.449613094 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.455202103 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.455216885 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.455224991 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.455298901 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.455408096 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.455418110 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.455490112 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.456629992 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.456662893 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.456698895 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.457586050 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.457618952 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.457653999 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.459141016 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.459175110 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.459206104 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.459208012 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.459295034 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.461313963 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.461349010 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.461427927 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.462362051 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.462394953 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.462459087 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.463907003 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.463941097 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.464056969 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.465441942 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.465454102 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.465517044 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.467041016 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.467051983 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.467060089 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.467139959 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.468631029 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.468641996 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.468704939 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.470232010 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.470242977 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.470299959 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.471782923 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.471793890 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.471983910 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.472944021 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.472954035 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.472963095 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.473175049 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.474102020 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.518071890 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.518104076 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.518357038 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.518591881 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.518929005 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.518939018 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.519005060 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.519535065 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.519546032 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.519632101 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.520720005 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.520730019 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.520864964 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.521884918 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.521894932 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.522169113 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.523049116 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.523058891 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.523066998 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.523111105 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.524205923 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.524215937 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.524280071 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.655566931 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.655720949 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.656500101 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.657361031 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.657393932 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.657444954 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.657947063 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.657980919 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.658020020 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.660023928 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.660135031 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.660195112 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.660229921 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.660262108 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.660784006 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.661998987 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.663192034 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.663228989 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.663259029 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.663275957 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.663460970 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.664211988 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.664246082 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.664278030 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.664313078 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.664705038 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.665234089 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.665268898 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.665324926 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.666441917 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.666475058 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.666527987 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.666569948 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.667614937 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.667648077 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.667740107 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.668776035 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.668808937 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.668839931 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.668845892 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.668941021 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.669926882 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.669960022 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.670114040 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.671087027 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.671119928 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.671295881 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.672241926 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.672275066 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.673455954 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.673490047 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.673521042 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.673525095 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.673563004 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.674560070 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.674640894 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.674715996 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.675673008 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.675707102 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.675743103 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.676732063 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.676764965 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.676829100 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.677721977 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.677755117 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.677788973 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.678812981 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.678845882 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.678877115 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.678880930 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.678939104 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.679815054 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.679847956 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.680187941 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.680761099 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.680794001 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.680984974 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.681477070 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.681509018 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.681870937 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.682440996 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.682473898 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.682691097 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.683353901 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.683387041 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.684113026 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.684297085 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.684329987 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.685226917 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.685261011 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.685265064 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.685292006 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.685378075 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.686099052 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.686424017 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.686703920 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.686925888 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.686959028 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.686995983 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.687717915 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.688131094 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.688163996 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.688246965 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.688981056 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.689014912 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.689109087 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.690083027 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.690119982 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.693528891 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.693562984 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.693810940 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.694137096 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.694169998 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.694950104 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.699031115 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.699080944 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.699112892 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.699120998 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.699146986 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.699177980 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.699182987 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.699235916 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.701828957 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.701862097 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.701992035 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.702300072 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.702333927 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.702393055 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.703047991 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.703082085 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.703236103 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.703937054 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.703969955 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.704952955 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.704986095 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.705017090 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.705022097 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.705050945 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.705523968 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.705557108 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.705593109 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.706315994 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.706348896 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.706386089 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.707138062 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.707170010 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.707209110 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.707962990 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.707995892 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.708028078 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.708034039 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.708411932 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.708774090 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.708806038 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.709424973 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.709582090 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.709614992 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.709788084 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.710391045 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.710422993 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.710900068 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.711169004 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.745090961 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.745435953 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.745601892 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.745645046 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.745706081 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.746033907 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.746454000 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.746469975 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.746498108 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.746646881 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.747200012 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.747591972 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.747610092 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.747706890 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.748003006 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.748018980 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.748100996 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.748869896 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.748975992 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.749187946 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.749593019 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.749608994 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.749641895 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.749660969 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.749764919 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.750344038 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.750794888 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.750811100 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751115084 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.751528025 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751857042 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751873016 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751887083 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751887083 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.751904011 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.751935959 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.752002001 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.752784014 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.752799988 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.752813101 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.752880096 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.785156965 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:46:59.798696995 CEST162049732104.243.242.165192.168.2.4
                        May 23, 2024 15:46:59.798768044 CEST497321620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:00.549215078 CEST49675443192.168.2.4173.222.162.32
                        May 23, 2024 15:47:03.811220884 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:03.816180944 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:03.816560984 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:03.816560984 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:03.875735044 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:03.876035929 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:03.881170034 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:04.735028028 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:04.735368013 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:04.740535021 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:04.830476046 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:04.835459948 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.230859041 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.233870983 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.239038944 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.602758884 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.603981018 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.606705904 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.606909037 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.609870911 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.609884024 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.609891891 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.609972954 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.609972954 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.615745068 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.615757942 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.615906000 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.618663073 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.618671894 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.618725061 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.624485016 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.624495983 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.624504089 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.624615908 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.628536940 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.628612041 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.675381899 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.675556898 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.827423096 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.828589916 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.828757048 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.830519915 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.831367970 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.831449986 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.833678007 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.833688021 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.833739042 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.833993912 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.838745117 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.838839054 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.841409922 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.841422081 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.841520071 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.846431971 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.846442938 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.846451044 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.846510887 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.846510887 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.850774050 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.850785017 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.850846052 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.854057074 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.854068041 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.854125023 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.857660055 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.857683897 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.857770920 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.861232042 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.861243963 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.861311913 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:05.864721060 CEST162049736104.243.242.165192.168.2.4
                        May 23, 2024 15:47:05.864810944 CEST497361620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:10.162365913 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:10.170614958 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:10.170707941 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:10.177953959 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:10.223576069 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.101604939 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.112829924 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.117918015 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.142960072 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.147850037 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.428904057 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.433749914 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.438847065 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.978936911 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.979760885 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.979830980 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.982309103 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.983582973 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.983614922 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.983697891 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.987353086 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.987411022 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.989257097 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.989268064 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.989275932 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.989330053 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.993040085 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.993050098 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.993088961 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:11.994929075 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.994940042 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:11.994980097 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.026680946 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.026722908 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.142967939 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.162178040 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.212218046 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.213030100 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.213073015 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.214941025 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.216875076 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.216886997 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.216922045 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.220666885 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.220707893 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.222562075 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.222570896 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.222605944 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.226345062 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.226355076 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.226361990 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.226385117 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.230144978 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.230154991 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.230190992 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.234694958 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.234724045 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.234762907 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.238661051 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.238671064 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.238712072 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.241528988 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.241539955 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.241575956 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.245348930 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.245372057 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.245379925 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.245491028 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.245491028 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.435900927 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.436642885 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.436723948 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.438463926 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.441495895 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.441529989 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.441559076 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.441561937 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.441705942 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.444237947 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.446156979 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.446190119 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.446216106 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.449997902 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.450031042 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.450056076 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.450064898 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.450119972 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.454746008 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.454780102 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.454840899 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.456912994 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.456990957 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.457046986 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.459985971 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.460019112 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.460050106 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.460078955 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.463001013 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.463035107 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.463078976 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.466118097 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.466150045 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.466181993 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.466185093 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.466238022 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.472366095 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.472398996 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.472429991 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.472461939 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.472484112 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.472523928 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.474881887 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.474915028 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.474967003 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.477634907 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.477669001 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.477725029 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.482347012 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.482378960 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.482410908 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.482537985 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.525008917 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.525152922 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.525681019 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.527115107 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.527160883 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.528498888 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.528532982 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.528563976 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.528582096 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.531290054 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.531327009 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.531348944 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.534074068 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.534106970 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.534126997 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.536875010 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.536907911 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.536938906 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.538026094 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.538058996 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.538086891 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.580409050 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.672511101 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.673090935 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.673295021 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.674330950 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.675693989 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.675709009 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.675858021 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.678327084 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.678489923 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.679678917 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.679694891 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.679708958 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.679851055 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.682337999 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.682353973 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.682384014 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.685117006 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.685132027 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.685146093 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.685225964 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.685226917 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.687119007 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.687134981 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.687295914 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.689251900 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.689266920 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.691395044 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.691411018 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.691926003 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.691926956 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.693568945 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.693584919 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.693598986 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.693649054 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.695616961 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.695632935 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.695663929 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.697568893 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.697585106 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.697634935 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.699517965 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.699533939 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.699589968 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.701421976 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.701438904 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.701478958 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.703270912 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.703286886 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.703300953 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.703321934 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.703353882 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.705135107 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.705162048 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.705200911 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.706818104 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.706834078 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.706885099 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.708512068 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.708528042 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.708686113 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.710153103 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.710169077 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.710182905 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.710218906 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.711786985 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.711802006 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.711831093 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.713376999 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.713392973 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.713428974 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.714905977 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.714921951 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.714955091 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.716619968 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.716635942 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.716672897 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.717853069 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.717868090 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.717883110 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.717897892 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.718046904 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.719278097 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.719294071 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.719459057 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.721005917 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.721020937 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.721072912 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.722065926 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.722081900 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.722148895 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.724066973 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.724081993 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.724097013 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.724138975 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.724668980 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.724684954 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.724710941 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.763828993 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.763889074 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.764275074 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.764872074 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.765027046 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.766525984 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.766542912 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.766601086 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.767267942 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.767966986 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.767982960 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.768043995 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.769438982 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.769455910 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.769470930 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.769511938 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.769545078 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.770935059 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.770951033 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.771011114 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.772443056 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.772459030 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.772516012 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.773621082 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.773637056 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.773688078 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.774944067 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.774960041 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.775012970 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.776048899 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.776067019 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.776081085 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.776113987 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.777404070 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.777420998 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.777432919 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.777463913 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.777498007 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.900353909 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.902947903 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.903105974 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.903239965 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.903255939 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.903302908 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.903899908 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.904555082 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.904568911 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.904592991 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.905250072 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.905266047 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.905308962 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.906616926 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.906680107 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.907244921 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.907962084 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.907978058 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.908010006 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.909379005 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.909394979 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.909420967 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.910679102 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.910695076 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.910707951 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.910743952 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.910768032 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.911672115 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.911686897 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.911750078 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.912772894 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.912787914 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.912827015 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.913856030 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.913867950 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.913919926 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.914912939 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.914925098 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.914933920 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.914977074 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.915987015 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.916022062 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.916043997 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.917090893 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.917136908 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.917154074 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.918138981 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.918174028 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.918210983 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.919111967 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.919147015 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.919169903 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.920094967 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.920129061 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.920152903 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.920181990 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.920692921 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.921078920 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.921114922 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.921165943 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.921996117 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.922012091 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.922060966 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.922867060 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.922883034 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.922934055 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.923748970 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.923764944 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.923778057 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.923824072 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.924634933 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.924649954 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.924699068 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.925501108 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.925517082 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.925546885 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.926368952 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.926383972 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.926409006 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.927211046 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.927227020 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.927257061 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.928060055 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.928073883 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.928083897 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.928098917 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.928128958 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.928886890 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.928900957 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.928934097 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.929703951 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.929717064 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.929757118 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.930500984 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.930514097 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.930576086 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.931335926 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.931349039 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.931360006 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.931404114 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.932022095 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.932034969 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.932074070 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.932800055 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.932812929 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.932852030 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.933532000 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.933545113 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.933583975 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.934278011 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.934290886 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.934328079 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.934956074 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.934967995 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.934978962 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.935012102 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.935020924 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.935672045 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.935683012 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.935734987 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.936373949 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.936386108 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.936429977 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.937060118 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.937072039 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.937141895 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.937755108 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.937767029 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.937777042 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.937812090 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.938441038 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.938453913 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.938486099 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.939132929 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.939143896 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.939152956 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.939183950 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.939213991 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.940114975 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.940143108 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.940151930 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.940185070 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.941072941 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.941085100 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.941096067 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.941107035 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.941117048 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.941163063 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.942090988 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.942102909 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.942114115 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.942145109 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.942172050 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.942954063 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.942965031 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.942975044 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.943001986 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.943870068 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.943881989 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.943892002 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.943903923 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.943918943 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.943943977 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.944735050 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.944746971 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.944756031 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.944772005 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.944798946 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.983042955 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.983130932 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.992100000 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.992151976 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.992428064 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.992572069 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.992661953 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.992714882 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.993019104 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993056059 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993091106 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993113041 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.993578911 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993616104 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993673086 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.993943930 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.993978977 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.994002104 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.994034052 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.994071960 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.994117975 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.994823933 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.994859934 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.994883060 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.995443106 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.995476007 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.995520115 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:12.995812893 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:12.995863914 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:13.035006046 CEST162049737104.243.242.165192.168.2.4
                        May 23, 2024 15:47:13.035165071 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:13.174303055 CEST497371620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:17.202248096 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:17.207397938 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:17.207506895 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:17.210441113 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:17.264275074 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:17.264354944 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:17.275005102 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:18.127584934 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:18.127809048 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:18.133987904 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:18.239422083 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:18.244615078 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:18.449552059 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:18.452658892 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:18.457773924 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:19.170419931 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:19.179037094 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:19.184448957 CEST162049744104.243.242.165192.168.2.4
                        May 23, 2024 15:47:19.236716032 CEST497441620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:23.264291048 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:23.272474051 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:23.275222063 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:23.275466919 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:23.327725887 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:24.180377007 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:24.180535078 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:24.242069006 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:24.267940044 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:24.272964001 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:24.499161005 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:24.503443003 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:24.508547068 CEST162049745104.243.242.165192.168.2.4
                        May 23, 2024 15:47:25.283638000 CEST497451620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:29.313409090 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:29.319353104 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:29.319434881 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:29.319713116 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:29.371620893 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:29.411753893 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:29.417155027 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:30.409015894 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:30.415963888 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:30.754959106 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:30.757483006 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:30.765265942 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:31.267353058 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:31.270908117 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:31.276050091 CEST162049746104.243.242.165192.168.2.4
                        May 23, 2024 15:47:31.411976099 CEST497461620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:35.438945055 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:35.444530010 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:35.446358919 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:35.446618080 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:35.499716043 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:36.367651939 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:36.367944002 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:36.373285055 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:36.408636093 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:36.414287090 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:36.683768988 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:36.686791897 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:36.692066908 CEST162049747104.243.242.165192.168.2.4
                        May 23, 2024 15:47:37.408633947 CEST497471620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:41.458394051 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:41.463964939 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:41.465385914 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:41.467838049 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:41.523691893 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:42.398086071 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:42.398350000 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:42.403836012 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:42.411065102 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:42.416297913 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:42.718206882 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:42.767899036 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:42.996392012 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.002321959 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.543709040 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.564888954 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.581459999 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.582129002 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.630825043 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.850511074 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.858762026 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.867815018 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.875381947 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.882566929 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:43.935213089 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:43.940742016 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:44.502428055 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:45.321415901 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:45.321522951 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:45.326105118 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:45.326141119 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:45.326169968 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:45.326195955 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:45.326199055 CEST162049748104.243.242.165192.168.2.4
                        May 23, 2024 15:47:45.326217890 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:45.326258898 CEST497481620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:48.528609991 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:48.534073114 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:48.534372091 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:48.534467936 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:48.587671995 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:49.486444950 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:49.486815929 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:49.492357016 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:49.518158913 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:49.523649931 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:49.807678938 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:49.810935020 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:49.816504002 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:50.030323029 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:50.080488920 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:50.465336084 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:50.470988989 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:50.476274967 CEST162049749104.243.242.165192.168.2.4
                        May 23, 2024 15:47:50.517966986 CEST497491620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:54.547784090 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:54.631256104 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:54.635293007 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:54.635411978 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:54.687359095 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:55.533842087 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:55.539191961 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:55.596565008 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:55.596848965 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:55.602029085 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:56.123275042 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:56.126136065 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:47:56.131248951 CEST162049751104.243.242.165192.168.2.4
                        May 23, 2024 15:47:56.604248047 CEST497511620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:00.766799927 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:00.784782887 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:00.784863949 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:00.788073063 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:00.839695930 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:01.127490997 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:01.132678032 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:01.694525003 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:01.694864035 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:01.703577042 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:02.017055035 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:02.020348072 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:02.025405884 CEST162049752104.243.242.165192.168.2.4
                        May 23, 2024 15:48:02.127386093 CEST497521620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:06.152338982 CEST497531620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:06.157289028 CEST162049753104.243.242.165192.168.2.4
                        May 23, 2024 15:48:06.157366037 CEST497531620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:06.158972025 CEST497531620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:06.211869955 CEST162049753104.243.242.165192.168.2.4
                        May 23, 2024 15:48:07.088720083 CEST162049753104.243.242.165192.168.2.4
                        May 23, 2024 15:48:07.091379881 CEST497531620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:07.105093002 CEST162049753104.243.242.165192.168.2.4
                        May 23, 2024 15:48:07.127441883 CEST497531620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:08.281095028 CEST4972380192.168.2.42.19.126.151
                        May 23, 2024 15:48:08.281142950 CEST4972480192.168.2.4199.232.210.172
                        May 23, 2024 15:48:08.286562920 CEST80497232.19.126.151192.168.2.4
                        May 23, 2024 15:48:08.286621094 CEST4972380192.168.2.42.19.126.151
                        May 23, 2024 15:48:08.354641914 CEST8049724199.232.210.172192.168.2.4
                        May 23, 2024 15:48:08.354691982 CEST4972480192.168.2.4199.232.210.172
                        May 23, 2024 15:48:11.153709888 CEST497541620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:11.158685923 CEST162049754104.243.242.165192.168.2.4
                        May 23, 2024 15:48:11.158759117 CEST497541620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:11.158993959 CEST497541620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:11.211374044 CEST162049754104.243.242.165192.168.2.4
                        May 23, 2024 15:48:12.072204113 CEST162049754104.243.242.165192.168.2.4
                        May 23, 2024 15:48:12.072532892 CEST497541620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:12.091558933 CEST162049754104.243.242.165192.168.2.4
                        May 23, 2024 15:48:12.127233028 CEST497541620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:16.181690931 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:16.186816931 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:16.186886072 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:16.187278032 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:16.239957094 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:17.111100912 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:17.173995018 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:17.376071930 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:17.385288000 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:17.694500923 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:17.736491919 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:18.047435045 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:18.058856010 CEST162049755104.243.242.165192.168.2.4
                        May 23, 2024 15:48:18.058892012 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:18.058917999 CEST497551620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:22.077156067 CEST497561620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:22.083285093 CEST162049756104.243.242.165192.168.2.4
                        May 23, 2024 15:48:22.083534956 CEST497561620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:22.083801985 CEST497561620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:22.138705969 CEST162049756104.243.242.165192.168.2.4
                        May 23, 2024 15:48:23.018610954 CEST162049756104.243.242.165192.168.2.4
                        May 23, 2024 15:48:23.018762112 CEST497561620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:23.023634911 CEST162049756104.243.242.165192.168.2.4
                        May 23, 2024 15:48:23.087697029 CEST497561620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:27.108050108 CEST497571620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:27.112974882 CEST162049757104.243.242.165192.168.2.4
                        May 23, 2024 15:48:27.113029957 CEST497571620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:27.113260984 CEST497571620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:27.163258076 CEST162049757104.243.242.165192.168.2.4
                        May 23, 2024 15:48:28.015703917 CEST162049757104.243.242.165192.168.2.4
                        May 23, 2024 15:48:28.016149998 CEST497571620192.168.2.4104.243.242.165
                        May 23, 2024 15:48:28.021039009 CEST162049757104.243.242.165192.168.2.4
                        May 23, 2024 15:48:28.096065044 CEST497571620192.168.2.4104.243.242.165

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        May 23, 2024 15:46:56.876147985 CEST6051853192.168.2.48.8.8.8
                        May 23, 2024 15:46:56.885766029 CEST53605188.8.8.8192.168.2.4
                        May 23, 2024 15:47:03.801042080 CEST5499053192.168.2.48.8.8.8
                        May 23, 2024 15:47:03.810233116 CEST53549908.8.8.8192.168.2.4
                        May 23, 2024 15:47:10.144380093 CEST5155953192.168.2.48.8.8.8
                        May 23, 2024 15:47:10.159089088 CEST53515598.8.8.8192.168.2.4
                        May 23, 2024 15:47:17.191318989 CEST6169453192.168.2.48.8.8.8
                        May 23, 2024 15:47:17.201508999 CEST53616948.8.8.8192.168.2.4
                        May 23, 2024 15:47:23.253621101 CEST5957653192.168.2.48.8.8.8
                        May 23, 2024 15:47:23.263489962 CEST53595768.8.8.8192.168.2.4
                        May 23, 2024 15:47:29.300508976 CEST6002553192.168.2.48.8.8.8
                        May 23, 2024 15:47:29.310802937 CEST53600258.8.8.8192.168.2.4
                        May 23, 2024 15:47:35.429822922 CEST5730453192.168.2.48.8.8.8
                        May 23, 2024 15:47:35.437947989 CEST53573048.8.8.8192.168.2.4
                        May 23, 2024 15:47:41.439472914 CEST6144953192.168.2.48.8.8.8
                        May 23, 2024 15:47:41.452563047 CEST53614498.8.8.8192.168.2.4
                        May 23, 2024 15:47:48.518832922 CEST5892353192.168.2.48.8.8.8
                        May 23, 2024 15:47:48.527988911 CEST53589238.8.8.8192.168.2.4
                        May 23, 2024 15:47:54.534435987 CEST6019653192.168.2.48.8.8.8
                        May 23, 2024 15:47:54.546072960 CEST53601968.8.8.8192.168.2.4
                        May 23, 2024 15:48:00.749634027 CEST5726753192.168.2.48.8.8.8
                        May 23, 2024 15:48:00.763087988 CEST53572678.8.8.8192.168.2.4
                        May 23, 2024 15:48:06.144095898 CEST6241853192.168.2.48.8.8.8
                        May 23, 2024 15:48:06.151668072 CEST53624188.8.8.8192.168.2.4
                        May 23, 2024 15:48:11.143938065 CEST6254653192.168.2.48.8.8.8
                        May 23, 2024 15:48:11.153093100 CEST53625468.8.8.8192.168.2.4
                        May 23, 2024 15:48:16.167520046 CEST5155453192.168.2.48.8.8.8
                        May 23, 2024 15:48:16.179789066 CEST53515548.8.8.8192.168.2.4
                        May 23, 2024 15:48:22.065913916 CEST5566153192.168.2.48.8.8.8
                        May 23, 2024 15:48:22.074158907 CEST53556618.8.8.8192.168.2.4
                        May 23, 2024 15:48:27.097287893 CEST6129653192.168.2.48.8.8.8
                        May 23, 2024 15:48:27.107409000 CEST53612968.8.8.8192.168.2.4

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                        May 23, 2024 15:46:56.876147985 CEST192.168.2.48.8.8.80xf1f5Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:03.801042080 CEST192.168.2.48.8.8.80xef1Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:10.144380093 CEST192.168.2.48.8.8.80x898eStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:17.191318989 CEST192.168.2.48.8.8.80x722eStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:23.253621101 CEST192.168.2.48.8.8.80x43a4Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:29.300508976 CEST192.168.2.48.8.8.80x441eStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:35.429822922 CEST192.168.2.48.8.8.80x843dStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:41.439472914 CEST192.168.2.48.8.8.80x3ecStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:48.518832922 CEST192.168.2.48.8.8.80x1b81Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:47:54.534435987 CEST192.168.2.48.8.8.80x5064Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:00.749634027 CEST192.168.2.48.8.8.80xac6dStandard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:06.144095898 CEST192.168.2.48.8.8.80x9dc8Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:11.143938065 CEST192.168.2.48.8.8.80xf108Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:16.167520046 CEST192.168.2.48.8.8.80xd168Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:22.065913916 CEST192.168.2.48.8.8.80xb402Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false
                        May 23, 2024 15:48:27.097287893 CEST192.168.2.48.8.8.80x2915Standard query (0)newsddawork.3utilities.comA (IP address)IN (0x0001)false

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                        May 23, 2024 15:46:56.885766029 CEST8.8.8.8192.168.2.40xf1f5No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:03.810233116 CEST8.8.8.8192.168.2.40xef1No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:10.159089088 CEST8.8.8.8192.168.2.40x898eNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:14.644126892 CEST1.1.1.1192.168.2.40x34e7No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        May 23, 2024 15:47:14.644126892 CEST1.1.1.1192.168.2.40x34e7No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:17.201508999 CEST8.8.8.8192.168.2.40x722eNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:23.263489962 CEST8.8.8.8192.168.2.40x43a4No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:28.198183060 CEST1.1.1.1192.168.2.40xaa6bNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                        May 23, 2024 15:47:28.198183060 CEST1.1.1.1192.168.2.40xaa6bNo error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:29.310802937 CEST8.8.8.8192.168.2.40x441eNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:35.437947989 CEST8.8.8.8192.168.2.40x843dNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:41.452563047 CEST8.8.8.8192.168.2.40x3ecNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:48.527988911 CEST8.8.8.8192.168.2.40x1b81No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:47:54.546072960 CEST8.8.8.8192.168.2.40x5064No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:00.763087988 CEST8.8.8.8192.168.2.40xac6dNo error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:06.151668072 CEST8.8.8.8192.168.2.40x9dc8No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:11.153093100 CEST8.8.8.8192.168.2.40xf108No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:16.179789066 CEST8.8.8.8192.168.2.40xd168No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:22.074158907 CEST8.8.8.8192.168.2.40xb402No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false
                        May 23, 2024 15:48:27.107409000 CEST8.8.8.8192.168.2.40x2915No error (0)newsddawork.3utilities.com104.243.242.165A (IP address)IN (0x0001)false

                        Statistics

                        CPU Usage

                        Click to jump to process

                        Memory Usage

                        Click to jump to process

                        High Level Behavior Distribution

                        Click to dive into process behavior distribution

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Target ID:0
                        Start time:09:46:53
                        Start date:23/05/2024
                        Path:C:\Users\user\Desktop\fLNzmBM9hR.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Users\user\Desktop\fLNzmBM9hR.exe"
                        Imagebase:0x640000
                        File size:641'536 bytes
                        MD5 hash:14239732DBDDFE922C297FDEAC56A062
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                        • Rule: Nanocore, Description: detect Nanocore in memory, Source: 00000000.00000002.1674369825.0000000003D2F000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                        Reputation:low
                        Has exited:true

                        General

                        Target ID:2
                        Start time:09:46:55
                        Start date:23/05/2024
                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe"
                        Imagebase:0x860000
                        File size:433'152 bytes
                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:3
                        Start time:09:46:55
                        Start date:23/05/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7699e0000
                        File size:862'208 bytes
                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:4
                        Start time:09:46:55
                        Start date:23/05/2024
                        Path:C:\Windows\SysWOW64\schtasks.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp7751.tmp"
                        Imagebase:0x60000
                        File size:187'904 bytes
                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:5
                        Start time:09:46:55
                        Start date:23/05/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7699e0000
                        File size:862'208 bytes
                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:6
                        Start time:09:46:55
                        Start date:23/05/2024
                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        Imagebase:0xf20000
                        File size:262'432 bytes
                        MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3092185822.0000000005F20000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096285589.0000000007760000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3087398590.0000000004543000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3095814524.0000000007710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3095890255.0000000007720000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3097033300.00000000079F0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3097298200.0000000007A30000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096864447.00000000077E0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096361141.0000000007770000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3097114258.0000000007A00000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096223687.0000000007750000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096480105.0000000007790000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096562078.00000000077A0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 00000006.00000002.3087398590.00000000045E0000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3081321042.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3096414766.0000000007780000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth
                        • Rule: MALWARE_Win_NanoCore, Description: Detects NanoCore, Source: 00000006.00000002.3094559477.0000000006A90000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 00000006.00000002.3081321042.00000000032AD000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:7
                        Start time:09:46:56
                        Start date:23/05/2024
                        Path:C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Users\user\AppData\Roaming\dgKDUvhlvCiVpa.exe
                        Imagebase:0x5c0000
                        File size:641'536 bytes
                        MD5 hash:14239732DBDDFE922C297FDEAC56A062
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth
                        • Rule: Nanocore, Description: detect Nanocore in memory, Source: 00000007.00000002.1696812697.0000000003DB0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                        Antivirus matches:
                        • Detection: 100%, Avira
                        • Detection: 100%, Joe Sandbox ML
                        • Detection: 76%, ReversingLabs
                        • Detection: 75%, Virustotal, Browse
                        Reputation:low
                        Has exited:true

                        General

                        Target ID:8
                        Start time:09:46:57
                        Start date:23/05/2024
                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                        Imagebase:0x7ff693ab0000
                        File size:496'640 bytes
                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                        Has elevated privileges:true
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:9
                        Start time:09:46:57
                        Start date:23/05/2024
                        Path:C:\Windows\SysWOW64\schtasks.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dgKDUvhlvCiVpa" /XML "C:\Users\user\AppData\Local\Temp\tmp802A.tmp"
                        Imagebase:0x60000
                        File size:187'904 bytes
                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:10
                        Start time:09:46:57
                        Start date:23/05/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7699e0000
                        File size:862'208 bytes
                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:11
                        Start time:09:46:57
                        Start date:23/05/2024
                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        Imagebase:0xb40000
                        File size:262'432 bytes
                        MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        • Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
                        • Rule: Nanocore, Description: detect Nanocore in memory, Source: 0000000B.00000002.1733374703.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.1736727761.0000000003F09000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        • Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                        • Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                        • Rule: NanoCore, Description: unknown, Source: 0000000B.00000002.1736360700.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:12
                        Start time:09:47:09
                        Start date:23/05/2024
                        Path:C:\Program Files (x86)\DNS Host\dnshost.exe
                        Wow64 process (32bit):true
                        Commandline:"C:\Program Files (x86)\DNS Host\dnshost.exe"
                        Imagebase:0x6e0000
                        File size:262'432 bytes
                        MD5 hash:8FDF47E0FF70C40ED3A17014AEEA4232
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Antivirus matches:
                        • Detection: 0%, ReversingLabs
                        • Detection: 1%, Virustotal, Browse
                        Reputation:moderate
                        Has exited:true

                        General

                        Target ID:13
                        Start time:09:47:10
                        Start date:23/05/2024
                        Path:C:\Windows\System32\conhost.exe
                        Wow64 process (32bit):false
                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Imagebase:0x7ff7699e0000
                        File size:862'208 bytes
                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                        Has elevated privileges:false
                        Has administrator privileges:false
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        General

                        Target ID:20
                        Start time:09:48:30
                        Start date:23/05/2024
                        Path:C:\Windows\SysWOW64\WerFault.exe
                        Wow64 process (32bit):true
                        Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 1416
                        Imagebase:0x5f0000
                        File size:483'680 bytes
                        MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Reputation:high
                        Has exited:true

                        Disassembly

                        Reset < >

                          Execution Graph

                          Execution Coverage:8.6%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:0%
                          Total number of Nodes:93
                          Total number of Limit Nodes:4
                          execution_graph 20455 4a92798 20456 4a92923 20455->20456 20457 4a927be 20455->20457 20457->20456 20459 4a90578 20457->20459 20460 4a92a18 PostMessageW 20459->20460 20461 4a92a84 20460->20461 20461->20457 20441 d6d3b8 20442 d6d3fe 20441->20442 20446 d6d598 20442->20446 20449 d6d589 20442->20449 20443 d6d4eb 20452 d6b710 20446->20452 20450 d6d5c6 20449->20450 20451 d6b710 DuplicateHandle 20449->20451 20450->20443 20451->20450 20453 d6d600 DuplicateHandle 20452->20453 20454 d6d5c6 20453->20454 20454->20443 20462 d64668 20463 d64672 20462->20463 20467 d64758 20462->20467 20472 d63e28 20463->20472 20465 d6468d 20468 d6477d 20467->20468 20476 d64858 20468->20476 20480 d64868 20468->20480 20473 d63e33 20472->20473 20488 d65c50 20473->20488 20475 d66faf 20475->20465 20477 d6488f 20476->20477 20478 d6496c 20477->20478 20484 d644b0 20477->20484 20481 d6488f 20480->20481 20482 d6496c 20481->20482 20483 d644b0 CreateActCtxA 20481->20483 20483->20482 20485 d658f8 CreateActCtxA 20484->20485 20487 d659bb 20485->20487 20489 d65c5b 20488->20489 20492 d65c70 20489->20492 20491 d67065 20491->20475 20493 d65c7b 20492->20493 20496 d65ca0 20493->20496 20495 d67142 20495->20491 20497 d65cab 20496->20497 20500 d65cd0 20497->20500 20499 d67245 20499->20495 20501 d65cdb 20500->20501 20503 d6854b 20501->20503 20507 d6abf8 20501->20507 20502 d68589 20502->20499 20503->20502 20511 d6cce0 20503->20511 20516 d6ccf0 20503->20516 20521 d6ac30 20507->20521 20524 d6ac20 20507->20524 20508 d6ac0e 20508->20503 20512 d6cd11 20511->20512 20513 d6cd35 20512->20513 20548 d6ce90 20512->20548 20552 d6cea0 20512->20552 20513->20502 20517 d6cd11 20516->20517 20518 d6cd35 20517->20518 20519 d6ce90 2 API calls 20517->20519 20520 d6cea0 2 API calls 20517->20520 20518->20502 20519->20518 20520->20518 20528 d6ad28 20521->20528 20522 d6ac3f 20522->20508 20525 d6ac30 20524->20525 20527 d6ad28 2 API calls 20525->20527 20526 d6ac3f 20526->20508 20527->20526 20529 d6ad39 20528->20529 20530 d6ad5c 20528->20530 20529->20530 20536 d6afc0 20529->20536 20540 d6afb0 20529->20540 20530->20522 20531 d6ad54 20531->20530 20532 d6af60 GetModuleHandleW 20531->20532 20533 d6af8d 20532->20533 20533->20522 20537 d6afd4 20536->20537 20539 d6aff9 20537->20539 20544 d6a0e8 20537->20544 20539->20531 20542 d6afc0 20540->20542 20541 d6aff9 20541->20531 20542->20541 20543 d6a0e8 LoadLibraryExW 20542->20543 20543->20541 20545 d6b1a0 LoadLibraryExW 20544->20545 20547 d6b219 20545->20547 20547->20539 20549 d6cead 20548->20549 20550 d6cee7 20549->20550 20556 d6b700 20549->20556 20550->20513 20553 d6cead 20552->20553 20554 d6cee7 20553->20554 20555 d6b700 2 API calls 20553->20555 20554->20513 20555->20554 20557 d6b70b 20556->20557 20559 d6dbf8 20557->20559 20560 d6d004 20557->20560 20559->20559 20561 d6d00f 20560->20561 20562 d65cd0 2 API calls 20561->20562 20563 d6dc67 20562->20563 20563->20559

                          Executed Functions

                          Function 00D6AD28 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 363 d6ad28-d6ad37 364 d6ad63-d6ad67 363->364 365 d6ad39-d6ad46 call d6a080 363->365 366 d6ad7b-d6adbc 364->366 367 d6ad69-d6ad73 364->367 372 d6ad5c 365->372 373 d6ad48 365->373 374 d6adbe-d6adc6 366->374 375 d6adc9-d6add7 366->375 367->366 372->364 418 d6ad4e call d6afc0 373->418 419 d6ad4e call d6afb0 373->419 374->375 376 d6adfb-d6adfd 375->376 377 d6add9-d6adde 375->377 379 d6ae00-d6ae07 376->379 380 d6ade0-d6ade7 call d6a08c 377->380 381 d6ade9 377->381 378 d6ad54-d6ad56 378->372 382 d6ae98-d6af58 378->382 383 d6ae14-d6ae1b 379->383 384 d6ae09-d6ae11 379->384 386 d6adeb-d6adf9 380->386 381->386 413 d6af60-d6af8b GetModuleHandleW 382->413 414 d6af5a-d6af5d 382->414 387 d6ae1d-d6ae25 383->387 388 d6ae28-d6ae2a call d6a09c 383->388 384->383 386->379 387->388 392 d6ae2f-d6ae31 388->392 394 d6ae33-d6ae3b 392->394 395 d6ae3e-d6ae43 392->395 394->395 396 d6ae45-d6ae4c 395->396 397 d6ae61-d6ae6e 395->397 396->397 399 d6ae4e-d6ae5e call d6a0ac call d6a0bc 396->399 403 d6ae70-d6ae8e 397->403 404 d6ae91-d6ae97 397->404 399->397 403->404 415 d6af94-d6afa8 413->415 416 d6af8d-d6af93 413->416 414->413 416->415 418->378 419->378
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00D6AF7E
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 36069461266de57a8b681f3289c7d08ea39949e32c0f0dc6eda016178fcade69
                          • Instruction ID: ab7702e3e939087ecfb086a278b9e21ed76b145ee59f570264f3f8f5a4045074
                          • Opcode Fuzzy Hash: 36069461266de57a8b681f3289c7d08ea39949e32c0f0dc6eda016178fcade69
                          • Instruction Fuzzy Hash: 59713470A00B058FD724DF2AD04575ABBF1FF88304F04892DE48AA7A51D775E945CFA2
                          Function 00D658EC Relevance: 1.6, APIs: 1, Instructions: 126COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 420 d658ec-d658f4 421 d658f6-d659b9 CreateActCtxA 420->421 422 d65891-d658b9 420->422 427 d659c2-d65a1c 421->427 428 d659bb-d659c1 421->428 425 d658c2-d658e3 422->425 426 d658bb-d658c1 422->426 426->425 436 d65a1e-d65a21 427->436 437 d65a2b-d65a2f 427->437 428->427 436->437 438 d65a40 437->438 439 d65a31-d65a3d 437->439 441 d65a41 438->441 439->438 441->441
                          APIs
                          • CreateActCtxA.KERNEL32(?), ref: 00D659A9
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: Create
                          • String ID:
                          • API String ID: 2289755597-0
                          • Opcode ID: b093bc52e522a84dc2ad1943740370c0994e6632cb1b7d34d6c3db768dd3ae22
                          • Instruction ID: 9eaae112a97380cac1a6c5b60d26a7cc541ccacfd81d64920390171c2c79bb59
                          • Opcode Fuzzy Hash: b093bc52e522a84dc2ad1943740370c0994e6632cb1b7d34d6c3db768dd3ae22
                          • Instruction Fuzzy Hash: 0C5102B0C00719CFDB24DFA9C8847DDBBF1AF48314F24806AD408AB255D775A989CFA1
                          Function 00D644B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 442 d644b0-d659b9 CreateActCtxA 445 d659c2-d65a1c 442->445 446 d659bb-d659c1 442->446 453 d65a1e-d65a21 445->453 454 d65a2b-d65a2f 445->454 446->445 453->454 455 d65a40 454->455 456 d65a31-d65a3d 454->456 458 d65a41 455->458 456->455 458->458
                          APIs
                          • CreateActCtxA.KERNEL32(?), ref: 00D659A9
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: Create
                          • String ID:
                          • API String ID: 2289755597-0
                          • Opcode ID: 7abb5f229f71a873dedd32e8c6ee0bc7760ac9864491d14bc0f5dd391ad74aca
                          • Instruction ID: eca70707fb0317e796fcb6035bc6aeec36a4372436996153246f6d49073bf938
                          • Opcode Fuzzy Hash: 7abb5f229f71a873dedd32e8c6ee0bc7760ac9864491d14bc0f5dd391ad74aca
                          • Instruction Fuzzy Hash: 6B41E2B0C0071DCBDB24DFAAC844B9EBBF5BF48314F20816AD409AB255DB716985CFA0
                          Function 00D6D6C1 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 459 d6d6c1-d6d6c8 460 d6d684-d6d694 DuplicateHandle 459->460 461 d6d6ca-d6d7ee 459->461 463 d6d696-d6d69c 460->463 464 d6d69d-d6d6ba 460->464 463->464
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D6D5C6,?,?,?,?,?), ref: 00D6D687
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: ad4847a3336e9b0f7a6a8e94df3946c833017710c7d44f617ab79ce8e59cd121
                          • Instruction ID: 3fda2744278fd4b8ae090697d7c92c59bf4b9bf4d802654b58c48a0818bcbf67
                          • Opcode Fuzzy Hash: ad4847a3336e9b0f7a6a8e94df3946c833017710c7d44f617ab79ce8e59cd121
                          • Instruction Fuzzy Hash: F83170347403448FEB08EF60F4587697BA2F7C4714F118439EA258B7D8CAB95886CB11
                          Function 00D6B710 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 477 d6b710-d6d694 DuplicateHandle 479 d6d696-d6d69c 477->479 480 d6d69d-d6d6ba 477->480 479->480
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D6D5C6,?,?,?,?,?), ref: 00D6D687
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 5e9914260281a944de3edc92eda5186b753cc7138af8f095d0454137c7ebd9f5
                          • Instruction ID: 99d84ced512e3b4eed40b87bd6ec9075335fad7bbce726c2ac0c59ca3a1c5fea
                          • Opcode Fuzzy Hash: 5e9914260281a944de3edc92eda5186b753cc7138af8f095d0454137c7ebd9f5
                          • Instruction Fuzzy Hash: F02105B5D003089FDB10CF9AD884AEEBBF9EB48320F14801AE918A3311D374A940CFA4
                          Function 00D6D5F8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 483 d6d5f8-d6d694 DuplicateHandle 484 d6d696-d6d69c 483->484 485 d6d69d-d6d6ba 483->485 484->485
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00D6D5C6,?,?,?,?,?), ref: 00D6D687
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: d91ef910522a30541c75db70f355e7653ef505843f1efd3ddc1d9279a9a5b7c2
                          • Instruction ID: 330646519723aa1266cc59f6b0d2ad72d33ea54175ad1efd9dd1fc6641fdb972
                          • Opcode Fuzzy Hash: d91ef910522a30541c75db70f355e7653ef505843f1efd3ddc1d9279a9a5b7c2
                          • Instruction Fuzzy Hash: E421E3B5D002099FDB10CF9AD485ADEBFF5EB48320F24841AE918A7351D374A944CFA1
                          Function 00D6A0E8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 488 d6a0e8-d6b1e0 490 d6b1e2-d6b1e5 488->490 491 d6b1e8-d6b217 LoadLibraryExW 488->491 490->491 492 d6b220-d6b23d 491->492 493 d6b219-d6b21f 491->493 493->492
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D6AFF9,00000800,00000000,00000000), ref: 00D6B20A
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 233686ada7ed9bbe72e2f01c4909b84be8c19b475d27bd06100cb6adba119e03
                          • Instruction ID: 4fc14265e4c96b8ef06cb6ad487c6ef26841680c801d0627062e02bf082960d6
                          • Opcode Fuzzy Hash: 233686ada7ed9bbe72e2f01c4909b84be8c19b475d27bd06100cb6adba119e03
                          • Instruction Fuzzy Hash: 8811E7B59003099FDB10DF9AD448B9EFBF4EB48320F14841AD559B7201C775A945CFA5
                          Function 00D6B198 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 496 d6b198-d6b1e0 497 d6b1e2-d6b1e5 496->497 498 d6b1e8-d6b217 LoadLibraryExW 496->498 497->498 499 d6b220-d6b23d 498->499 500 d6b219-d6b21f 498->500 500->499
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D6AFF9,00000800,00000000,00000000), ref: 00D6B20A
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 3c1f05cc03da715206e1a256ba76e7b6dd6e20f16ef06c4857c127029bf7beb2
                          • Instruction ID: 2087f654653f11b8ed1b21340a9463c149640e47a1ad95177f448e146260f10e
                          • Opcode Fuzzy Hash: 3c1f05cc03da715206e1a256ba76e7b6dd6e20f16ef06c4857c127029bf7beb2
                          • Instruction Fuzzy Hash: F61129B6C003098FDB10CF9AD444ADEFBF4EB48320F14841AD519B7200C379A945CFA5
                          Function 00D6AF18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 503 d6af18-d6af58 504 d6af60-d6af8b GetModuleHandleW 503->504 505 d6af5a-d6af5d 503->505 506 d6af94-d6afa8 504->506 507 d6af8d-d6af93 504->507 505->504 507->506
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00D6AF7E
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: dc45022a58462e29416a8b8d5fb3c06563c17671275c21a7856a2762f020cc78
                          • Instruction ID: d82361a018b1e223bd8d144451121924e98c8dfc40b7c924381d524038d9a234
                          • Opcode Fuzzy Hash: dc45022a58462e29416a8b8d5fb3c06563c17671275c21a7856a2762f020cc78
                          • Instruction Fuzzy Hash: 8411DFB5C003498FDB10DF9AC444A9EFBF4EF88324F14845AE469B7210C379A545CFA2
                          Function 04A90578 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 509 4a90578-4a92a82 PostMessageW 511 4a92a8b-4a92a9f 509->511 512 4a92a84-4a92a8a 509->512 512->511
                          APIs
                          • PostMessageW.USER32(?,00000010,00000000,?), ref: 04A92A75
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: MessagePost
                          • String ID:
                          • API String ID: 410705778-0
                          • Opcode ID: d907cec9cef61df27885bdabf40900dc972e848eb121986519c76cefde82ef93
                          • Instruction ID: 283d2fa558f1b3388bb5dfcd3b209fb8d96af72442c91211c9dddd65e5eb66e9
                          • Opcode Fuzzy Hash: d907cec9cef61df27885bdabf40900dc972e848eb121986519c76cefde82ef93
                          • Instruction Fuzzy Hash: AD110AB68003499FDB10DF99C445BDEBBF8EB58320F108859D514B7601C375A944CFA1
                          Function 04A92A10 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 514 4a92a10-4a92a82 PostMessageW 515 4a92a8b-4a92a9f 514->515 516 4a92a84-4a92a8a 514->516 516->515
                          APIs
                          • PostMessageW.USER32(?,00000010,00000000,?), ref: 04A92A75
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID: MessagePost
                          • String ID:
                          • API String ID: 410705778-0
                          • Opcode ID: f659fab861d50198482137b264ca9dd111fc80c597c9bf1c7be918fb340d5f84
                          • Instruction ID: b66dd503738571a43d73bc4e0244e0c168c7ca8ab2d139500250f2eabdcea4f4
                          • Opcode Fuzzy Hash: f659fab861d50198482137b264ca9dd111fc80c597c9bf1c7be918fb340d5f84
                          • Instruction Fuzzy Hash: CC1103B68003499FDB10CF99C989BDEBBF8EF48324F10885AD558B7601C374A984CFA1
                          Function 00CAD3D8 Relevance: .1, Instructions: 75COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672665308.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cad000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 00ea8fcd01e63b8ca3a0e91ceea04666e1a8c120b3c67e88d02f0f51dcbd7765
                          • Instruction ID: ee71710a74272f4dd39a0a8450cac94e9e6d213179553e85bc5829a3edbc46ee
                          • Opcode Fuzzy Hash: 00ea8fcd01e63b8ca3a0e91ceea04666e1a8c120b3c67e88d02f0f51dcbd7765
                          • Instruction Fuzzy Hash: 8F2148B1500305DFDB01DF04C9C4B16BF65FB98328F20C568E80B0B656C336E856CBA2
                          Function 00CBD01C Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672735279.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cbd000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: bea3a77221eb5ca9452cfb88386ec1877f479b8667fdab4eef2894ac2b59fb0e
                          • Instruction ID: 3334fc2dd4511040efb33214cd38bbc19de433b0efe56e1171230c2b73ed83d9
                          • Opcode Fuzzy Hash: bea3a77221eb5ca9452cfb88386ec1877f479b8667fdab4eef2894ac2b59fb0e
                          • Instruction Fuzzy Hash: B221D375604200DFCB14EF14E9C4B56BBA5EB94314F24C569D80B4B286D33AD807CA61
                          Function 00CBD1D4 Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672735279.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cbd000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: ce4191e8cc66c1cf4c1b5e5fdd258f9d7087990320ef56d7192545ea024f7e0f
                          • Instruction ID: ba95156ffd90854ccb3c272c8034465eabbf37be22a2b4f321b0e0db89b22093
                          • Opcode Fuzzy Hash: ce4191e8cc66c1cf4c1b5e5fdd258f9d7087990320ef56d7192545ea024f7e0f
                          • Instruction Fuzzy Hash: ED21F575604240EFDB05DF14D9C4B65BBA5FB94314F24C6ADE80B4B292D336DC46CB62
                          Function 00CBD005 Relevance: .1, Instructions: 62COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672735279.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cbd000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 09a0cb09f926351cca48b560a30f420264cd0c4301c50ee20e31f0db78519560
                          • Instruction ID: 95a41fdd58a9626cf0980c0b331c8c89569995c391bc7bee188c5443718bf461
                          • Opcode Fuzzy Hash: 09a0cb09f926351cca48b560a30f420264cd0c4301c50ee20e31f0db78519560
                          • Instruction Fuzzy Hash: 3F219F755093C08FCB02DF24D994715BF71EB46314F28C5EAD84A8F2A7C33A980ACB62
                          Function 00CAD3D3 Relevance: .1, Instructions: 56COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672665308.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cad000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction ID: b5a69952c58e1f57f0200457b4a63035cd8de433d829e3c321c2303f4946ca5e
                          • Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction Fuzzy Hash: 25112676504341CFDB02CF00D5C4B16BF72FB98324F24C2A9D80A0B656C33AE95ACBA1
                          Function 00CBD1CF Relevance: .1, Instructions: 53COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672735279.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cbd000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction ID: 8cb0ddab276958d26be10c108e2832624db2b5a57b11bd492f1f902a6bcfa897
                          • Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction Fuzzy Hash: EB11BB75904280DFCB02CF10C5C4B15BBB2FB84324F24C6ADD84A4B296C33AD84ACB62
                          Function 00CAD759 Relevance: .0, Instructions: 45COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672665308.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cad000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 088aba75486239cf3489c989c58e643bbf97941bf89bcfaba5c50937410e1595
                          • Instruction ID: 37be418e72fcef316a873312c52ec84d5f9887ee1253a0e13c832b239734ddc2
                          • Opcode Fuzzy Hash: 088aba75486239cf3489c989c58e643bbf97941bf89bcfaba5c50937410e1595
                          • Instruction Fuzzy Hash: B5012B710083459AE7144B16DCC4B66FFE8DF52339F18C85AEC1F8A68AC3389840C671
                          Function 00CAD758 Relevance: .0, Instructions: 36COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672665308.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_cad000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 1e059ffefcfa6ae84c3a796898ef75defe685d09dbe97fe59d3a9b9b3d7db8de
                          • Instruction ID: 9f2dac907bfc5767f5491ea3c57cb8cca3c52932031c65e9db7e04da5c96134a
                          • Opcode Fuzzy Hash: 1e059ffefcfa6ae84c3a796898ef75defe685d09dbe97fe59d3a9b9b3d7db8de
                          • Instruction Fuzzy Hash: BDF0F6310043409EE7248B06DC84B62FFE8EF51735F18C45AED1A4B28AC379AC40CAB1

                          Non-executed Functions

                          Function 04A93628 Relevance: 2.8, Strings: 2, Instructions: 298COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID: PH^q$PH^q
                          • API String ID: 0-1598597984
                          • Opcode ID: a3a8badac460ec99e40c0b4d5a186338e45a5b02bba652e8cab51a8ade4353be
                          • Instruction ID: 5d38af5bcf15011f6789ea20f7844b4a48bda576df3f559bd04c6cf8c34ba75c
                          • Opcode Fuzzy Hash: a3a8badac460ec99e40c0b4d5a186338e45a5b02bba652e8cab51a8ade4353be
                          • Instruction Fuzzy Hash: D3D1A274A00605CFDB18DF69C598BA9B7F1BF4C701F2580A9E90AAB361DB31AD41CF60
                          Function 04A95520 Relevance: .4, Instructions: 354COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 027b23b9a64bc97b408fa3adea326575371a0cd1c7704074188faa394ab4a1e7
                          • Instruction ID: 81f395ed8a906130bc410561b2b8b70d47bb907d96e6a59aa2d90f7229d155be
                          • Opcode Fuzzy Hash: 027b23b9a64bc97b408fa3adea326575371a0cd1c7704074188faa394ab4a1e7
                          • Instruction Fuzzy Hash: 83D1BC72B006009BEB1ADB79C551B6EB7FAAF89304F14886DD186DB291DF35EC01CB61
                          Function 04A90AC8 Relevance: .3, Instructions: 312COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 243b2f73a8c0d589db0f7ba8db3838cab2ca81ef21bc7c8447a3651f84099c28
                          • Instruction ID: d5bc2c66761dd8ae36dda30c3475ec94f4616f61a73235653bb90d775a4e6501
                          • Opcode Fuzzy Hash: 243b2f73a8c0d589db0f7ba8db3838cab2ca81ef21bc7c8447a3651f84099c28
                          • Instruction Fuzzy Hash: 8AE1C674E051198FCB14DFA9C5909AEBBF2FF89304F248169D414AB359D731AD82CFA1
                          Function 00D6D2E4 Relevance: .3, Instructions: 264COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1672946729.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_d60000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 0529d4669d2038ec4c4b752804e6e7296e6899d84b5fe49456a4a4e674c92a3c
                          • Instruction ID: 84c5f5e863bdce084ecf1fd1b0e9749b3cf166464707c60fa9cd9bfb988310a7
                          • Opcode Fuzzy Hash: 0529d4669d2038ec4c4b752804e6e7296e6899d84b5fe49456a4a4e674c92a3c
                          • Instruction Fuzzy Hash: 81A17E36E006099FCF19DFB4D84059EB7B2FF85300B15857AE906AB265DB31ED46CB60
                          Function 04A90AB9 Relevance: .1, Instructions: 130COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000000.00000002.1675503096.0000000004A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A90000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_0_2_4a90000_fLNzmBM9hR.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 7c7a5389655be0f7c56bb68b3db0a16853bebcc17b2ae5916b77d960217cc7e0
                          • Instruction ID: 8a38a2ce46c32e49c86ea150eab073bee563fdda61820797292159b8d07a0573
                          • Opcode Fuzzy Hash: 7c7a5389655be0f7c56bb68b3db0a16853bebcc17b2ae5916b77d960217cc7e0
                          • Instruction Fuzzy Hash: 26510874E052198BCB14CFA9C9805AEFBF2FF89304F24C569D418AB355D731A942CFA1

                          Execution Graph

                          Execution Coverage:12.3%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:10.7%
                          Total number of Nodes:121
                          Total number of Limit Nodes:12
                          execution_graph 36963 6ac511f 36964 6ac5096 36963->36964 36965 6ac5123 36963->36965 36966 6ac516a 36965->36966 36969 6ac5180 36965->36969 36975 6ac5170 36965->36975 36970 6ac5185 36969->36970 36981 6ac52b8 36970->36981 36986 6ac51b8 36970->36986 36991 6ac51a8 36970->36991 36971 6ac519c 36971->36966 36976 6ac5185 36975->36976 36978 6ac52b8 DnsQuery_A 36976->36978 36979 6ac51a8 DnsQuery_A 36976->36979 36980 6ac51b8 DnsQuery_A 36976->36980 36977 6ac519c 36977->36966 36978->36977 36979->36977 36980->36977 36982 6ac524f 36981->36982 36983 6ac52c3 36981->36983 36982->36971 36983->36982 37001 6ac388c 36983->37001 36987 6ac51d6 36986->36987 36988 6ac51fe 36987->36988 36989 6ac52b8 DnsQuery_A 36987->36989 37005 6ac52c8 36987->37005 36988->36971 36989->36987 36992 6ac51af 36991->36992 36993 6ac515a 36991->36993 36992->36993 36994 6ac51b3 36992->36994 36997 6ac5180 DnsQuery_A 36993->36997 36998 6ac5170 DnsQuery_A 36993->36998 36996 6ac51fe 36994->36996 36999 6ac52b8 DnsQuery_A 36994->36999 37000 6ac52c8 DnsQuery_A 36994->37000 36995 6ac516a 36995->36971 36996->36971 36997->36995 36998->36995 36999->36994 37000->36994 37002 6ac5540 DnsQuery_A 37001->37002 37004 6ac567a 37002->37004 37006 6ac52f1 37005->37006 37007 6ac388c DnsQuery_A 37006->37007 37008 6ac5332 37007->37008 37008->36987 36871 17ed418 36872 17ed419 GetCurrentProcess 36871->36872 36874 17ed4a9 36872->36874 36875 17ed4b0 GetCurrentThread 36872->36875 36874->36875 36876 17ed4ed GetCurrentProcess 36875->36876 36877 17ed4e6 36875->36877 36878 17ed523 36876->36878 36877->36876 36879 17ed54b GetCurrentThreadId 36878->36879 36880 17ed57c 36879->36880 36881 77d58d1 36882 77d58f5 36881->36882 36886 77d59e9 36882->36886 36900 77d59f8 36882->36900 36883 77d594d 36887 77d59f8 36886->36887 36895 77d59e9 5 API calls 36887->36895 36897 77d59f8 5 API calls 36887->36897 36913 77d5ae8 36887->36913 36917 77d5b05 36887->36917 36922 77d5acb 36887->36922 36888 77d5a0c 36890 77d5a43 36888->36890 36926 77d506c 36888->36926 36890->36883 36891 77d5aa4 36891->36883 36893 77d5e16 GetSystemTimes 36894 77d5e53 36893->36894 36894->36883 36895->36888 36897->36888 36908 77d59e9 5 API calls 36900->36908 36909 77d5ae8 GetSystemTimes 36900->36909 36910 77d59f8 5 API calls 36900->36910 36911 77d5acb GetSystemTimes 36900->36911 36912 77d5b05 GetSystemTimes 36900->36912 36901 77d5a0c 36902 77d506c GetSystemTimes 36901->36902 36903 77d5a43 36901->36903 36905 77d5aa0 36902->36905 36903->36883 36904 77d5aa4 36904->36883 36905->36904 36906 77d5e16 GetSystemTimes 36905->36906 36907 77d5e53 36906->36907 36907->36883 36908->36901 36909->36901 36910->36901 36911->36901 36912->36901 36914 77d5afa GetSystemTimes 36913->36914 36916 77d5e53 36914->36916 36916->36888 36918 77d5b17 36917->36918 36919 77d5e16 GetSystemTimes 36918->36919 36921 77d5b29 36918->36921 36920 77d5e53 36919->36920 36920->36888 36921->36888 36923 77d5add GetSystemTimes 36922->36923 36925 77d5e53 36923->36925 36925->36888 36927 77d5dc8 GetSystemTimes 36926->36927 36929 77d5aa0 36927->36929 36929->36891 36929->36893 36868 17ed660 36869 17ed661 DuplicateHandle 36868->36869 36870 17ed6f6 36869->36870 36930 17eac90 36931 17eac91 36930->36931 36935 17ead78 36931->36935 36943 17ead88 36931->36943 36932 17eac9f 36936 17ead7c 36935->36936 36937 17eadbc 36936->36937 36951 17eb020 36936->36951 36955 17eb010 36936->36955 36937->36932 36938 17eadb4 36938->36937 36939 17eafc0 GetModuleHandleW 36938->36939 36940 17eafed 36939->36940 36940->36932 36944 17ead89 36943->36944 36945 17eadbc 36944->36945 36949 17eb020 LoadLibraryExW 36944->36949 36950 17eb010 LoadLibraryExW 36944->36950 36945->36932 36946 17eadb4 36946->36945 36947 17eafc0 GetModuleHandleW 36946->36947 36948 17eafed 36947->36948 36948->36932 36949->36946 36950->36946 36952 17eb021 36951->36952 36954 17eb059 36952->36954 36959 17ea148 36952->36959 36954->36938 36956 17eb014 36955->36956 36957 17eb059 36956->36957 36958 17ea148 LoadLibraryExW 36956->36958 36957->36938 36958->36957 36960 17eb200 LoadLibraryExW 36959->36960 36962 17eb279 36960->36962 36962->36954 37009 17edd40 37010 17edd41 37009->37010 37012 17edd97 37010->37012 37014 17ede3f 37010->37014 37015 17ed100 GetFocus 37010->37015 37013 17ede3a KiUserCallbackDispatcher 37012->37013 37012->37014 37013->37014 37015->37012

                          Executed Functions

                          Function 077D59F8 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: e08810d76f1a4ecdd74aa0d87a876dc5f043d776ba779d02d91de4091565632a
                          • Instruction ID: f2bdda7fe37073f358d89b0f0511d287e1102de5cb49517542d47d814fdc2c7d
                          • Opcode Fuzzy Hash: e08810d76f1a4ecdd74aa0d87a876dc5f043d776ba779d02d91de4091565632a
                          • Instruction Fuzzy Hash: E451AF71D012199FCB10EFA9D984AEEBFF5EF49310F10816AE918A7340D7309918CBA2
                          Function 06ACE4C8 Relevance: .1, Instructions: 126COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3094786365.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_6ac0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: a0c3add32ab40e0673614a0d38e59f12c778a91fe7291b757797d1fd7080f296
                          • Instruction ID: ed96420e6cc45602d323dcf2cb2371822bbffbd99b7b5835c6b8404dfb7d81d4
                          • Opcode Fuzzy Hash: a0c3add32ab40e0673614a0d38e59f12c778a91fe7291b757797d1fd7080f296
                          • Instruction Fuzzy Hash: E0511578E012089FDB44DFA8E899AADBFB2FB88311F148069E905A7350DB356D81CF50
                          Function 017ED408 Relevance: 6.1, APIs: 4, Instructions: 139threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 737 17ed408-17ed40a 738 17ed40c-17ed410 737->738 739 17ed411-17ed412 737->739 738->739 740 17ed419-17ed4a7 GetCurrentProcess 739->740 741 17ed414-17ed418 739->741 746 17ed4a9-17ed4af 740->746 747 17ed4b0-17ed4e4 GetCurrentThread 740->747 741->740 746->747 748 17ed4ed-17ed521 GetCurrentProcess 747->748 749 17ed4e6-17ed4ec 747->749 751 17ed52a-17ed545 call 17ed5e7 748->751 752 17ed523-17ed529 748->752 749->748 754 17ed54b-17ed57a GetCurrentThreadId 751->754 752->751 756 17ed57c-17ed582 754->756 757 17ed583-17ed5e5 754->757 756->757
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 017ED496
                          • GetCurrentThread.KERNEL32 ref: 017ED4D3
                          • GetCurrentProcess.KERNEL32 ref: 017ED510
                          • GetCurrentThreadId.KERNEL32 ref: 017ED569
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: b32e238f3b45dc4cef461607c7f320ad5de187dacf5dcace8cbb1d562fe5f90e
                          • Instruction ID: b0dcf4744101b457f0465b6227db28c29dc1f8344076c4147b316b494f923685
                          • Opcode Fuzzy Hash: b32e238f3b45dc4cef461607c7f320ad5de187dacf5dcace8cbb1d562fe5f90e
                          • Instruction Fuzzy Hash: EB5176B09043498FDB18DFA9D548B9EBFF1EF4C314F20806AD409A7390D774A984CB65
                          Function 017ED418 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 764 17ed418-17ed4a7 GetCurrentProcess 769 17ed4a9-17ed4af 764->769 770 17ed4b0-17ed4e4 GetCurrentThread 764->770 769->770 771 17ed4ed-17ed521 GetCurrentProcess 770->771 772 17ed4e6-17ed4ec 770->772 774 17ed52a-17ed545 call 17ed5e7 771->774 775 17ed523-17ed529 771->775 772->771 777 17ed54b-17ed57a GetCurrentThreadId 774->777 775->774 779 17ed57c-17ed582 777->779 780 17ed583-17ed5e5 777->780 779->780
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 017ED496
                          • GetCurrentThread.KERNEL32 ref: 017ED4D3
                          • GetCurrentProcess.KERNEL32 ref: 017ED510
                          • GetCurrentThreadId.KERNEL32 ref: 017ED569
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: 9e953c26ef29bc7f0da7b9b32aaf7b00cd6b428345c7bffd4162e957715d88d2
                          • Instruction ID: 4d9fefc67d8a7aaac22b2685c51b19555830d20e8c967783317fd296ad71b04d
                          • Opcode Fuzzy Hash: 9e953c26ef29bc7f0da7b9b32aaf7b00cd6b428345c7bffd4162e957715d88d2
                          • Instruction Fuzzy Hash: 925135B09003098FDB18DFAAD548B9EBBF1EF8C314F20C459E419A7390D774A984CB65
                          Function 06AC5488 Relevance: 1.7, APIs: 1, Instructions: 227COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3094786365.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_6ac0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 109d8b35e4fe7b5e6ecdb3a578f1ea4b5651c00ab852ea2edd3a1b4ca952e739
                          • Instruction ID: e5c44ec4fc0bba857721ec1b0b5c399ae81cbe876db52117edd4ebfbfb3b94fd
                          • Opcode Fuzzy Hash: 109d8b35e4fe7b5e6ecdb3a578f1ea4b5651c00ab852ea2edd3a1b4ca952e739
                          • Instruction Fuzzy Hash: 80918CB1D003099FCB50EFA9C9806DEBBF6FF49310F24812AE415AB251DB70A959CF91
                          Function 077D5B05 Relevance: 1.7, APIs: 1, Instructions: 225timeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimes.KERNELBASE(?,?,?), ref: 077D5E44
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID: SystemTimes
                          • String ID:
                          • API String ID: 375623090-0
                          • Opcode ID: ab075251f2a2bbccfe5f1937ccbd42d434fa77cd66ac64ee21c157c84422e62c
                          • Instruction ID: 32810068bd80ca2eaff2f98ed9233eda7f09aaed50dfdc9b44dfabd8c55a6318
                          • Opcode Fuzzy Hash: ab075251f2a2bbccfe5f1937ccbd42d434fa77cd66ac64ee21c157c84422e62c
                          • Instruction Fuzzy Hash: 02B19FB5D0021ACFDB10DF69C880AD9FBB5FF59310F15C69AD958AB201E770AA85CF90
                          Function 017EAD88 Relevance: 1.7, APIs: 1, Instructions: 198COMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 017EAFDE
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: c22155b4b51f9d4b00d1006b2058de370709df422647b2d16b9566c669b9b684
                          • Instruction ID: 546dfa2f44d798ce918b6bd83356842bfcee46f4fc001405784af9afc1cd9a5c
                          • Opcode Fuzzy Hash: c22155b4b51f9d4b00d1006b2058de370709df422647b2d16b9566c669b9b684
                          • Instruction Fuzzy Hash: 677122B0A00B058FDB24DF2AD44975ABBF1FF88314F008A2DD58AD7A44DB75E945CB90
                          Function 06AC3850 Relevance: 1.7, APIs: 1, Instructions: 175COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3094786365.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_6ac0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: d56b15a849b73e06fbfc2725ebd787afdf4e065d8e5ec1ae8a9863fc71d2d0f4
                          • Instruction ID: 26f7098d8dd8e7a4509697b8f35a0baee3824ad995567e0a4402c98290b965bd
                          • Opcode Fuzzy Hash: d56b15a849b73e06fbfc2725ebd787afdf4e065d8e5ec1ae8a9863fc71d2d0f4
                          • Instruction Fuzzy Hash: 4F6178B1C043599FDB11EFA9C890BDEBFF1AF45314F28805AE804AB251DB74A849CF91
                          Function 06AC388C Relevance: 1.6, APIs: 1, Instructions: 140networkCOMMON
                          Download Yara Rule
                          APIs
                          • DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06AC5668
                          Memory Dump Source
                          • Source File: 00000006.00000002.3094786365.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_6ac0000_MSBuild.jbxd
                          Similarity
                          • API ID: Query_
                          • String ID:
                          • API String ID: 428220571-0
                          • Opcode ID: ae9c4609540c1944ff68c975c06315dae62031ea9f0288a1e8bc08ec0a36cb6f
                          • Instruction ID: ddc377a4174e9a9e95f8564a133f31568fed3d3562be869208302b3388273ab1
                          • Opcode Fuzzy Hash: ae9c4609540c1944ff68c975c06315dae62031ea9f0288a1e8bc08ec0a36cb6f
                          • Instruction Fuzzy Hash: A65113B0D006199FCB54DFA9C880ADEBBF1FF48314F24812AE814AB250DB74A956CF91
                          Function 077D5AE8 Relevance: 1.6, APIs: 1, Instructions: 80timeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimes.KERNELBASE(?,?,?), ref: 077D5E44
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID: SystemTimes
                          • String ID:
                          • API String ID: 375623090-0
                          • Opcode ID: 1f2cecdf231f96ac575c11bfbc67d4db317540526999e4a21e27c1fbd9956161
                          • Instruction ID: 905a05471324ac7e5aa70fd6a1d77a6a7d8b0ff2e4bfcb93ea78a9a6f3cb9a0e
                          • Opcode Fuzzy Hash: 1f2cecdf231f96ac575c11bfbc67d4db317540526999e4a21e27c1fbd9956161
                          • Instruction Fuzzy Hash: AB3112B1C012589FCB10DFA9D584ADEFFF4AF49310F2481AAE908EB341D3349944CBA5
                          Function 077D5ACB Relevance: 1.6, APIs: 1, Instructions: 80timeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimes.KERNELBASE(?,?,?), ref: 077D5E44
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID: SystemTimes
                          • String ID:
                          • API String ID: 375623090-0
                          • Opcode ID: f286e866c6089ad5c3d70c25817338d6c0e723c900bad4dd1415ccbb1d0fd824
                          • Instruction ID: 3dbec719eeca0aec3be184d9a2455aef3bb891bc5d39c6827322e4db6f4fc515
                          • Opcode Fuzzy Hash: f286e866c6089ad5c3d70c25817338d6c0e723c900bad4dd1415ccbb1d0fd824
                          • Instruction Fuzzy Hash: 223111B1D012499FCB00DFA9D484ADEFFF4AF49310F2080AAE918EB251D3389944CFA5
                          Function 017ED658 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                          Download Yara Rule
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017ED6E7
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 5ae9ade6070b8b490bea05a65a66cf8eeada3e50692d1995992bbf0112051ae2
                          • Instruction ID: 735a0c4186fe21be56783a126ef404b17fed8379b39791f763fcc83475ef884e
                          • Opcode Fuzzy Hash: 5ae9ade6070b8b490bea05a65a66cf8eeada3e50692d1995992bbf0112051ae2
                          • Instruction Fuzzy Hash: AE21E2B5900209AFDB10DF9AD885AEEBBF5EB48310F14811AE918A3350D375AA54DFA1
                          Function 017ED660 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                          Download Yara Rule
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017ED6E7
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 5f1e954273f57214f24a72954ca1193e435dfc31dfec646aa4e94755fea2f5bf
                          • Instruction ID: 95f99a9a4ee04cab89f889b44bf7fef28938f5645f7ff0503806827fc29445f8
                          • Opcode Fuzzy Hash: 5f1e954273f57214f24a72954ca1193e435dfc31dfec646aa4e94755fea2f5bf
                          • Instruction Fuzzy Hash: 1321E4B59002089FDB10CF9AD884ADEFFF5EB48310F14801AE918A3350C374A954CFA4
                          Function 077D506C Relevance: 1.6, APIs: 1, Instructions: 61timeCOMMON
                          Download Yara Rule
                          APIs
                          • GetSystemTimes.KERNELBASE(?,?,?), ref: 077D5E44
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID: SystemTimes
                          • String ID:
                          • API String ID: 375623090-0
                          • Opcode ID: e516bf4a518e816a61cc609d4e64dda9d399c4e6f604b2ef088126d33b5b5ff7
                          • Instruction ID: 31de0a5616bd3f505c6998d7bb0790539e1d88861e68cb40713334d05ee4897c
                          • Opcode Fuzzy Hash: e516bf4a518e816a61cc609d4e64dda9d399c4e6f604b2ef088126d33b5b5ff7
                          • Instruction Fuzzy Hash: 2621E4B1D012199FCB40DFAAD584BDEFBF4EF48310F24806AE908AB241D7749A54CBA5
                          Function 017EB1F8 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017EB059,00000800,00000000,00000000), ref: 017EB26A
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: de4a372aef7079ead91afceacbd909ee2d39c4d5d21a00b57c06feb31340ad93
                          • Instruction ID: 95ac1356de23d6c5e6a869431899c5ca7747ebef644e9a39cabd4e6ed309a1b4
                          • Opcode Fuzzy Hash: de4a372aef7079ead91afceacbd909ee2d39c4d5d21a00b57c06feb31340ad93
                          • Instruction Fuzzy Hash: A12144B68043089FDB14DF9AC848ADEFFF9EF89320F10842AE559A7200C375A545CFA5
                          Function 017EA148 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017EB059,00000800,00000000,00000000), ref: 017EB26A
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: af5b01d5574a1865b9433fc7326929fdb684e0a51c63fa3d149c99c6c4064beb
                          • Instruction ID: 9b23cba2e771276dbdfef2a74d8448703f1c6cab0f09a9624008dd99206906d2
                          • Opcode Fuzzy Hash: af5b01d5574a1865b9433fc7326929fdb684e0a51c63fa3d149c99c6c4064beb
                          • Instruction Fuzzy Hash: E71114B68043099FDB10DF9AC448A9EFFF9EF88310F10846AD519AB200C375A544CFA4
                          Function 017EAF78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 017EAFDE
                          Memory Dump Source
                          • Source File: 00000006.00000002.3080178357.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_17e0000_MSBuild.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: d617ca1470b8d48361ad5b2c51db8ea9560080df7aa6775024ba18ca7e0a906d
                          • Instruction ID: 9cf6e43975f22b3465e0a4d74ad3c2d222a82240e267c8a5712a00e55de21454
                          • Opcode Fuzzy Hash: d617ca1470b8d48361ad5b2c51db8ea9560080df7aa6775024ba18ca7e0a906d
                          • Instruction Fuzzy Hash: 061122B5C003498FDB10DF9AC448ADEFBF4EF88324F10846AD529A7240C379A545CFA1
                          Function 0170D01C Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3079870424.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_170d000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: bec77f0f86b8ff8bb3786f97360b2de37fb1cd3b3f7230f339684faad80bb283
                          • Instruction ID: 27ebf2408f0006fae9d15f1e3368d9aaac2ff1d6059541b0230001f75a64e77f
                          • Opcode Fuzzy Hash: bec77f0f86b8ff8bb3786f97360b2de37fb1cd3b3f7230f339684faad80bb283
                          • Instruction Fuzzy Hash: 7F21D3B5604304DFDB26DF98D9C4B16FBA5EB84354F24C5ADD90E4B286C336D407CA61
                          Function 0170D017 Relevance: .1, Instructions: 53COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3079870424.000000000170D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0170D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_170d000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction ID: 4d081ff27febd8386c1cfcc655e7cc5e2bc174533a0d93c08b5e5c104183dfc7
                          • Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction Fuzzy Hash: 8C11BE75504380CFDB12CF54D5C4B15FBA2FB44324F24C6A9D8094B696C33AD40ACB62

                          Non-executed Functions

                          Function 077D02B9 Relevance: .0, Instructions: 50COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: c19d581932592de2404c77befe94909336dcfe13fff3a516ac83e8801daf229f
                          • Instruction ID: c15edbc36caa46a879e8b7b87c3970bd93dff24f99fbfb8f7a789e895a1e1570
                          • Opcode Fuzzy Hash: c19d581932592de2404c77befe94909336dcfe13fff3a516ac83e8801daf229f
                          • Instruction Fuzzy Hash: 4C01DB71D121189FDB049FA9E80C7EDBFB5EB8E351F046069D109B3250D7B44C44CB68
                          Function 077D02C8 Relevance: .0, Instructions: 44COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000006.00000002.3096797499.00000000077D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077D0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_6_2_77d0000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 4b3ca49d734ab7433d11c891930f61bb114415cefd2977910e32461a59dcaa45
                          • Instruction ID: 1ba083eda11e0e17dfa7d8171c5f757e7e4d812d3a686e4d52838299de9289ec
                          • Opcode Fuzzy Hash: 4b3ca49d734ab7433d11c891930f61bb114415cefd2977910e32461a59dcaa45
                          • Instruction Fuzzy Hash: 64F0A470E012148FDB049FAAE5087FDBFB5EB8E311F04646AD109B7290D7B54C44CB68

                          Execution Graph

                          Execution Coverage:10.1%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:0%
                          Total number of Nodes:222
                          Total number of Limit Nodes:8
                          execution_graph 31815 f1d6c1 31816 f1d684 DuplicateHandle 31815->31816 31818 f1d6ca 31815->31818 31817 f1d696 31816->31817 31536 f1d3b8 31537 f1d3fe GetCurrentProcess 31536->31537 31539 f1d450 GetCurrentThread 31537->31539 31540 f1d449 31537->31540 31541 f1d486 31539->31541 31542 f1d48d GetCurrentProcess 31539->31542 31540->31539 31541->31542 31545 f1d4c3 31542->31545 31543 f1d4eb GetCurrentThreadId 31544 f1d51c 31543->31544 31545->31543 31546 f14668 31547 f14672 31546->31547 31551 f14758 31546->31551 31556 f13e28 31547->31556 31549 f1468d 31552 f1477d 31551->31552 31560 f14868 31552->31560 31564 f14858 31552->31564 31557 f13e33 31556->31557 31572 f15c50 31557->31572 31559 f16faf 31559->31549 31561 f1488f 31560->31561 31562 f1496c 31561->31562 31568 f144b0 31561->31568 31565 f1488f 31564->31565 31566 f144b0 CreateActCtxA 31565->31566 31567 f1496c 31565->31567 31566->31567 31569 f158f8 CreateActCtxA 31568->31569 31571 f159bb 31569->31571 31571->31571 31573 f15c5b 31572->31573 31576 f15c70 31573->31576 31575 f17065 31575->31559 31577 f15c7b 31576->31577 31580 f15ca0 31577->31580 31579 f17142 31579->31575 31581 f15cab 31580->31581 31584 f15cd0 31581->31584 31583 f17245 31583->31579 31585 f15cdb 31584->31585 31587 f1854b 31585->31587 31590 f1abf8 31585->31590 31586 f18589 31586->31583 31587->31586 31594 f1cce0 31587->31594 31599 f1ac30 31590->31599 31602 f1ac20 31590->31602 31591 f1ac0e 31591->31587 31595 f1cd11 31594->31595 31596 f1cd35 31595->31596 31626 f1cea0 31595->31626 31630 f1ce9f 31595->31630 31596->31586 31606 f1ad28 31599->31606 31600 f1ac3f 31600->31591 31603 f1ac30 31602->31603 31605 f1ad28 2 API calls 31603->31605 31604 f1ac3f 31604->31591 31605->31604 31607 f1ad39 31606->31607 31609 f1ad5c 31606->31609 31607->31609 31614 f1afc0 31607->31614 31618 f1afb0 31607->31618 31608 f1ad54 31608->31609 31610 f1af60 GetModuleHandleW 31608->31610 31609->31600 31611 f1af8d 31610->31611 31611->31600 31615 f1afd4 31614->31615 31617 f1aff9 31615->31617 31622 f1a0e8 31615->31622 31617->31608 31619 f1afd4 31618->31619 31620 f1aff9 31619->31620 31621 f1a0e8 LoadLibraryExW 31619->31621 31620->31608 31621->31620 31623 f1b1a0 LoadLibraryExW 31622->31623 31625 f1b219 31623->31625 31625->31617 31627 f1cead 31626->31627 31629 f1cee7 31627->31629 31634 f1b700 31627->31634 31629->31596 31632 f1cead 31630->31632 31631 f1cee7 31631->31596 31632->31631 31633 f1b700 2 API calls 31632->31633 31633->31631 31635 f1b70b 31634->31635 31637 f1dbf8 31635->31637 31638 f1d004 31635->31638 31637->31637 31639 f1d00f 31638->31639 31640 f15cd0 2 API calls 31639->31640 31641 f1dc67 31640->31641 31641->31637 31819 fd1bc0 31821 fd1be6 31819->31821 31822 fd1d4b 31819->31822 31821->31822 31823 fd00b8 31821->31823 31824 fd1e40 PostMessageW 31823->31824 31825 fd1eac 31824->31825 31825->31821 31642 71be385 31643 71be24a 31642->31643 31644 71be58b 31643->31644 31648 fd09c6 31643->31648 31665 fd0960 31643->31665 31681 fd0951 31643->31681 31649 fd0952 31648->31649 31651 fd09c9 31648->31651 31650 fd0982 31649->31650 31697 fd0ddf 31649->31697 31701 fd1623 31649->31701 31706 fd1240 31649->31706 31711 fd10a0 31649->31711 31716 fd150a 31649->31716 31720 fd13ae 31649->31720 31724 fd120f 31649->31724 31728 fd102c 31649->31728 31733 fd116c 31649->31733 31738 fd0f32 31649->31738 31743 fd0e70 31649->31743 31748 fd1316 31649->31748 31753 fd1178 31649->31753 31650->31644 31651->31644 31666 fd097a 31665->31666 31667 fd0982 31666->31667 31668 fd0ddf 2 API calls 31666->31668 31669 fd1178 2 API calls 31666->31669 31670 fd1316 2 API calls 31666->31670 31671 fd0e70 2 API calls 31666->31671 31672 fd0f32 2 API calls 31666->31672 31673 fd116c 2 API calls 31666->31673 31674 fd102c 2 API calls 31666->31674 31675 fd120f 2 API calls 31666->31675 31676 fd13ae 2 API calls 31666->31676 31677 fd150a 2 API calls 31666->31677 31678 fd10a0 2 API calls 31666->31678 31679 fd1240 2 API calls 31666->31679 31680 fd1623 2 API calls 31666->31680 31667->31644 31668->31667 31669->31667 31670->31667 31671->31667 31672->31667 31673->31667 31674->31667 31675->31667 31676->31667 31677->31667 31678->31667 31679->31667 31680->31667 31682 fd0952 31681->31682 31683 fd0ddf 2 API calls 31682->31683 31684 fd1178 2 API calls 31682->31684 31685 fd0982 31682->31685 31686 fd1316 2 API calls 31682->31686 31687 fd0e70 2 API calls 31682->31687 31688 fd0f32 2 API calls 31682->31688 31689 fd116c 2 API calls 31682->31689 31690 fd102c 2 API calls 31682->31690 31691 fd120f 2 API calls 31682->31691 31692 fd13ae 2 API calls 31682->31692 31693 fd150a 2 API calls 31682->31693 31694 fd10a0 2 API calls 31682->31694 31695 fd1240 2 API calls 31682->31695 31696 fd1623 2 API calls 31682->31696 31683->31685 31684->31685 31685->31644 31686->31685 31687->31685 31688->31685 31689->31685 31690->31685 31691->31685 31692->31685 31693->31685 31694->31685 31695->31685 31696->31685 31757 71bde30 31697->31757 31761 71bde24 31697->31761 31702 fd1629 31701->31702 31765 71bdba8 31702->31765 31769 71bdba1 31702->31769 31703 fd165b 31707 fd1263 31706->31707 31709 71bdba8 WriteProcessMemory 31707->31709 31710 71bdba1 WriteProcessMemory 31707->31710 31708 fd12e3 31709->31708 31710->31708 31713 fd0f6a 31711->31713 31712 fd130f 31712->31650 31713->31712 31773 71bd528 31713->31773 31777 71bd522 31713->31777 31718 71bdba8 WriteProcessMemory 31716->31718 31719 71bdba1 WriteProcessMemory 31716->31719 31717 fd152e 31718->31717 31719->31717 31721 fd13df 31720->31721 31781 71bdc98 31720->31781 31785 71bdc90 31720->31785 31789 fd1a1f 31724->31789 31794 fd1a20 31724->31794 31725 fd122b 31729 fd0f6a 31728->31729 31729->31728 31730 fd130f 31729->31730 31731 71bd528 ResumeThread 31729->31731 31732 71bd522 ResumeThread 31729->31732 31730->31650 31731->31729 31732->31729 31734 fd13bd 31733->31734 31736 71bdc98 ReadProcessMemory 31734->31736 31737 71bdc90 ReadProcessMemory 31734->31737 31735 fd13df 31736->31735 31737->31735 31739 fd0f43 31738->31739 31741 71bdba8 WriteProcessMemory 31739->31741 31742 71bdba1 WriteProcessMemory 31739->31742 31740 fd165b 31741->31740 31742->31740 31744 fd0e00 31743->31744 31745 fd0e1a 31743->31745 31744->31745 31746 71bde30 CreateProcessA 31744->31746 31747 71bde24 CreateProcessA 31744->31747 31745->31650 31746->31745 31747->31745 31749 fd13fe 31748->31749 31807 71bd5d8 31749->31807 31811 71bd5d0 31749->31811 31750 fd1419 31750->31650 31755 71bd5d8 Wow64SetThreadContext 31753->31755 31756 71bd5d0 Wow64SetThreadContext 31753->31756 31754 fd1192 31755->31754 31756->31754 31758 71bdeb9 31757->31758 31758->31758 31759 71be01e CreateProcessA 31758->31759 31760 71be07b 31759->31760 31760->31760 31762 71bde30 CreateProcessA 31761->31762 31764 71be07b 31762->31764 31764->31764 31766 71bdbf0 WriteProcessMemory 31765->31766 31768 71bdc47 31766->31768 31768->31703 31770 71bdbf0 WriteProcessMemory 31769->31770 31772 71bdc47 31770->31772 31772->31703 31774 71bd568 ResumeThread 31773->31774 31776 71bd599 31774->31776 31776->31713 31778 71bd528 ResumeThread 31777->31778 31780 71bd599 31778->31780 31780->31713 31782 71bdce3 ReadProcessMemory 31781->31782 31784 71bdd27 31782->31784 31784->31721 31786 71bdc98 ReadProcessMemory 31785->31786 31788 71bdd27 31786->31788 31788->31721 31790 fd1a35 31789->31790 31799 71bdae8 31790->31799 31803 71bdae0 31790->31803 31791 fd1a54 31791->31725 31795 fd1a35 31794->31795 31797 71bdae8 VirtualAllocEx 31795->31797 31798 71bdae0 VirtualAllocEx 31795->31798 31796 fd1a54 31796->31725 31797->31796 31798->31796 31800 71bdb28 VirtualAllocEx 31799->31800 31802 71bdb65 31800->31802 31802->31791 31804 71bdae8 VirtualAllocEx 31803->31804 31806 71bdb65 31804->31806 31806->31791 31808 71bd61d Wow64SetThreadContext 31807->31808 31810 71bd665 31808->31810 31810->31750 31812 71bd5d8 Wow64SetThreadContext 31811->31812 31814 71bd665 31812->31814 31814->31750

                          Executed Functions

                          Function 00F1D3A8 Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 340 f1d3a8-f1d447 GetCurrentProcess 344 f1d450-f1d484 GetCurrentThread 340->344 345 f1d449-f1d44f 340->345 346 f1d486-f1d48c 344->346 347 f1d48d-f1d4c1 GetCurrentProcess 344->347 345->344 346->347 348 f1d4c3-f1d4c9 347->348 349 f1d4ca-f1d4e5 call f1d589 347->349 348->349 353 f1d4eb-f1d51a GetCurrentThreadId 349->353 354 f1d523-f1d585 353->354 355 f1d51c-f1d522 353->355 355->354
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 00F1D436
                          • GetCurrentThread.KERNEL32 ref: 00F1D473
                          • GetCurrentProcess.KERNEL32 ref: 00F1D4B0
                          • GetCurrentThreadId.KERNEL32 ref: 00F1D509
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: 8d13cb01ed67fe2ce5e46a8a1afda29d513635bb31f4ae5c4ea89c168dcde1b1
                          • Instruction ID: 208a0a90a606855555786007833bb95ea7ba282214041052a9a8b1223ac921e1
                          • Opcode Fuzzy Hash: 8d13cb01ed67fe2ce5e46a8a1afda29d513635bb31f4ae5c4ea89c168dcde1b1
                          • Instruction Fuzzy Hash: A75166B0D003498FDB54DFAAD588BDEBBF1EF88314F248459E009A7391DB34A985CB65
                          Function 00F1D3B8 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 362 f1d3b8-f1d447 GetCurrentProcess 366 f1d450-f1d484 GetCurrentThread 362->366 367 f1d449-f1d44f 362->367 368 f1d486-f1d48c 366->368 369 f1d48d-f1d4c1 GetCurrentProcess 366->369 367->366 368->369 370 f1d4c3-f1d4c9 369->370 371 f1d4ca-f1d4e5 call f1d589 369->371 370->371 375 f1d4eb-f1d51a GetCurrentThreadId 371->375 376 f1d523-f1d585 375->376 377 f1d51c-f1d522 375->377 377->376
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 00F1D436
                          • GetCurrentThread.KERNEL32 ref: 00F1D473
                          • GetCurrentProcess.KERNEL32 ref: 00F1D4B0
                          • GetCurrentThreadId.KERNEL32 ref: 00F1D509
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: d0fc245887e7fbc5eaf4c2eede7e47807f022073944b6fcff57b2ace0fe7029a
                          • Instruction ID: 7ddac8534a7807688c2d420f1687763064d4f2fc8f7a637b6ece654524461704
                          • Opcode Fuzzy Hash: d0fc245887e7fbc5eaf4c2eede7e47807f022073944b6fcff57b2ace0fe7029a
                          • Instruction Fuzzy Hash: 7A5143B0D003098FDB14DFAAD588BDEBBF1AF88314F208459E019A7291DB74A985CB65
                          Function 071BDE24 Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 673 71bde24-71bdec5 676 71bdefe-71bdf1e 673->676 677 71bdec7-71bded1 673->677 682 71bdf20-71bdf2a 676->682 683 71bdf57-71bdf86 676->683 677->676 678 71bded3-71bded5 677->678 679 71bdef8-71bdefb 678->679 680 71bded7-71bdee1 678->680 679->676 684 71bdee3 680->684 685 71bdee5-71bdef4 680->685 682->683 686 71bdf2c-71bdf2e 682->686 693 71bdf88-71bdf92 683->693 694 71bdfbf-71be079 CreateProcessA 683->694 684->685 685->685 687 71bdef6 685->687 688 71bdf51-71bdf54 686->688 689 71bdf30-71bdf3a 686->689 687->679 688->683 691 71bdf3e-71bdf4d 689->691 692 71bdf3c 689->692 691->691 695 71bdf4f 691->695 692->691 693->694 696 71bdf94-71bdf96 693->696 705 71be07b-71be081 694->705 706 71be082-71be108 694->706 695->688 698 71bdfb9-71bdfbc 696->698 699 71bdf98-71bdfa2 696->699 698->694 700 71bdfa6-71bdfb5 699->700 701 71bdfa4 699->701 700->700 703 71bdfb7 700->703 701->700 703->698 705->706 716 71be10a-71be10e 706->716 717 71be118-71be11c 706->717 716->717 718 71be110 716->718 719 71be11e-71be122 717->719 720 71be12c-71be130 717->720 718->717 719->720 721 71be124 719->721 722 71be132-71be136 720->722 723 71be140-71be144 720->723 721->720 722->723 724 71be138 722->724 725 71be156-71be15d 723->725 726 71be146-71be14c 723->726 724->723 727 71be15f-71be16e 725->727 728 71be174 725->728 726->725 727->728 730 71be175 728->730 730->730
                          APIs
                          • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071BE066
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: CreateProcess
                          • String ID:
                          • API String ID: 963392458-0
                          • Opcode ID: f8579fc449706064adf8ca730a0054bb78e889c9c1049d7cdfd616f6ae92852f
                          • Instruction ID: 7b9873d30fe6776ba43a865380619f6e87cf8ca888fd0105de489d81e42e2c50
                          • Opcode Fuzzy Hash: f8579fc449706064adf8ca730a0054bb78e889c9c1049d7cdfd616f6ae92852f
                          • Instruction Fuzzy Hash: 9BA180B1D0021ADFDF25DF68C8417DDBBB2BF44314F1481A9E848A7280DB749986CF92
                          Function 071BDE30 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 731 71bde30-71bdec5 733 71bdefe-71bdf1e 731->733 734 71bdec7-71bded1 731->734 739 71bdf20-71bdf2a 733->739 740 71bdf57-71bdf86 733->740 734->733 735 71bded3-71bded5 734->735 736 71bdef8-71bdefb 735->736 737 71bded7-71bdee1 735->737 736->733 741 71bdee3 737->741 742 71bdee5-71bdef4 737->742 739->740 743 71bdf2c-71bdf2e 739->743 750 71bdf88-71bdf92 740->750 751 71bdfbf-71be079 CreateProcessA 740->751 741->742 742->742 744 71bdef6 742->744 745 71bdf51-71bdf54 743->745 746 71bdf30-71bdf3a 743->746 744->736 745->740 748 71bdf3e-71bdf4d 746->748 749 71bdf3c 746->749 748->748 752 71bdf4f 748->752 749->748 750->751 753 71bdf94-71bdf96 750->753 762 71be07b-71be081 751->762 763 71be082-71be108 751->763 752->745 755 71bdfb9-71bdfbc 753->755 756 71bdf98-71bdfa2 753->756 755->751 757 71bdfa6-71bdfb5 756->757 758 71bdfa4 756->758 757->757 760 71bdfb7 757->760 758->757 760->755 762->763 773 71be10a-71be10e 763->773 774 71be118-71be11c 763->774 773->774 775 71be110 773->775 776 71be11e-71be122 774->776 777 71be12c-71be130 774->777 775->774 776->777 778 71be124 776->778 779 71be132-71be136 777->779 780 71be140-71be144 777->780 778->777 779->780 781 71be138 779->781 782 71be156-71be15d 780->782 783 71be146-71be14c 780->783 781->780 784 71be15f-71be16e 782->784 785 71be174 782->785 783->782 784->785 787 71be175 785->787 787->787
                          APIs
                          • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 071BE066
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: CreateProcess
                          • String ID:
                          • API String ID: 963392458-0
                          • Opcode ID: 40e4e8183078c3b22dd02d6197648d500b93f23db2a8b234b05aaaa6f4571789
                          • Instruction ID: ab27e1f219155b9c5cf51862a63ab29b8dad49de2e1c2c359ae2576b3a5776c3
                          • Opcode Fuzzy Hash: 40e4e8183078c3b22dd02d6197648d500b93f23db2a8b234b05aaaa6f4571789
                          • Instruction Fuzzy Hash: 4F917FB1E0021ADFDF25DFA9C8417DDBBB2BF44314F1481A9E849A7280DB749985CF92
                          Function 00F1AD28 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 788 f1ad28-f1ad37 789 f1ad63-f1ad67 788->789 790 f1ad39-f1ad46 call f1a080 788->790 791 f1ad69-f1ad73 789->791 792 f1ad7b-f1adbc 789->792 795 f1ad48 790->795 796 f1ad5c 790->796 791->792 799 f1adc9-f1add7 792->799 800 f1adbe-f1adc6 792->800 843 f1ad4e call f1afc0 795->843 844 f1ad4e call f1afb0 795->844 796->789 802 f1add9-f1adde 799->802 803 f1adfb-f1adfd 799->803 800->799 801 f1ad54-f1ad56 801->796 804 f1ae98-f1af58 801->804 806 f1ade0-f1ade7 call f1a08c 802->806 807 f1ade9 802->807 805 f1ae00-f1ae07 803->805 838 f1af60-f1af8b GetModuleHandleW 804->838 839 f1af5a-f1af5d 804->839 810 f1ae14-f1ae1b 805->810 811 f1ae09-f1ae11 805->811 809 f1adeb-f1adf9 806->809 807->809 809->805 813 f1ae28-f1ae2a call f1a09c 810->813 814 f1ae1d-f1ae25 810->814 811->810 817 f1ae2f-f1ae31 813->817 814->813 819 f1ae33-f1ae3b 817->819 820 f1ae3e-f1ae43 817->820 819->820 821 f1ae61-f1ae6e 820->821 822 f1ae45-f1ae4c 820->822 829 f1ae91-f1ae97 821->829 830 f1ae70-f1ae8e 821->830 822->821 824 f1ae4e-f1ae5e call f1a0ac call f1a0bc 822->824 824->821 830->829 840 f1af94-f1afa8 838->840 841 f1af8d-f1af93 838->841 839->838 841->840 843->801 844->801
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00F1AF7E
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 7d40d5696dc3477b0651eca523f112fcf9137052ee83018ddfdaf2efa3536fbb
                          • Instruction ID: 48305e5f9cfb95e7d6b170ec6ca1198b36d4350fbb93a6000b2698608c29a4cf
                          • Opcode Fuzzy Hash: 7d40d5696dc3477b0651eca523f112fcf9137052ee83018ddfdaf2efa3536fbb
                          • Instruction Fuzzy Hash: 0F7157B0A01B058FD724DF2AD45179ABBF1FF88314F00892EE48AD7A50DB34E985DB91
                          Function 00F144B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 845 f144b0-f159b9 CreateActCtxA 848 f159c2-f15a1c 845->848 849 f159bb-f159c1 845->849 856 f15a2b-f15a2f 848->856 857 f15a1e-f15a21 848->857 849->848 858 f15a31-f15a3d 856->858 859 f15a40 856->859 857->856 858->859 861 f15a41 859->861 861->861
                          APIs
                          • CreateActCtxA.KERNEL32(?), ref: 00F159A9
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: Create
                          • String ID:
                          • API String ID: 2289755597-0
                          • Opcode ID: 89979364db1cf9e79714e082d5a8b4ceeea9962a852196240752aadce9ab16ad
                          • Instruction ID: 88351f4a8813f6a840b707b68d2c6c293c03781a7e549e5baeecd4b4b07c9ee5
                          • Opcode Fuzzy Hash: 89979364db1cf9e79714e082d5a8b4ceeea9962a852196240752aadce9ab16ad
                          • Instruction Fuzzy Hash: B741D4B0C00719CBDB24DFA9C8847DEBBF5BF88714F20816AD409AB251DB756945CF91
                          Function 00F158EC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                          Download Yara Rule
                          APIs
                          • CreateActCtxA.KERNEL32(?), ref: 00F159A9
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: Create
                          • String ID:
                          • API String ID: 2289755597-0
                          • Opcode ID: 37c3b1054d7caf407bdb4daad9e58b7d0c035c8e9252450c5db1ae70f83bf277
                          • Instruction ID: b26e29d58ae9f3970b8fa14b583063cd26cfd9021918b1f6dfdece2212d77677
                          • Opcode Fuzzy Hash: 37c3b1054d7caf407bdb4daad9e58b7d0c035c8e9252450c5db1ae70f83bf277
                          • Instruction Fuzzy Hash: 0941F2B0C00719CBDB24DFA9C8847DEBBF5BF89714F20816AD409AB251DB756986CF50
                          Function 00F1D6C1 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                          Download Yara Rule
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F1D687
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 6c48152e811a3088b686cd164cf5717c29fbbf87c714190cf4e55a3fadb64fed
                          • Instruction ID: 5fd932af8fa7506fb2cea4e4d30b0b9e4dc2098b1e4862d3164bdbb559c7881b
                          • Opcode Fuzzy Hash: 6c48152e811a3088b686cd164cf5717c29fbbf87c714190cf4e55a3fadb64fed
                          • Instruction Fuzzy Hash: 74318534A803888FE304EF65E8947797BB2F7C8350F11843AE9118B7E4CAB4885ADF11
                          Function 071BDBA1 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                          Download Yara Rule
                          APIs
                          • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071BDC38
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: bc59eea5a915c7187aa7166ddc641702e851f14448a5c44242df9fc924da9d08
                          • Instruction ID: 0bccd8d908d967a82fc20535f0f0ffb45864a1f54008ba22edbc95216dec2170
                          • Opcode Fuzzy Hash: bc59eea5a915c7187aa7166ddc641702e851f14448a5c44242df9fc924da9d08
                          • Instruction Fuzzy Hash: 622168B59103499FCB14DFA9C8807EEBBF1FF48310F108429E958A7241C7749955CBA4
                          Function 071BD5D0 Relevance: 1.6, APIs: 1, Instructions: 69threadCOMMON
                          Download Yara Rule
                          APIs
                          • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071BD656
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: ContextThreadWow64
                          • String ID:
                          • API String ID: 983334009-0
                          • Opcode ID: 70ce0aa6e17d0ec7e3c64c6139944f9ac4463326c9fefe3f594e7122462f103a
                          • Instruction ID: 2abb7871c2912efe2ab9c8ccea6df8090ea8a851d05188085ee41dc451f4b69a
                          • Opcode Fuzzy Hash: 70ce0aa6e17d0ec7e3c64c6139944f9ac4463326c9fefe3f594e7122462f103a
                          • Instruction Fuzzy Hash: C02178B19003099FCB14DFAAC4857EEBFF4EF88320F10842AD459A7281CB789945CFA5
                          Function 071BDC90 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                          Download Yara Rule
                          APIs
                          • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071BDD18
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MemoryProcessRead
                          • String ID:
                          • API String ID: 1726664587-0
                          • Opcode ID: 31b092787bb6a4f30555ec37cdbccb9f01d87d0a364808b82b8ef9c9ceb530f9
                          • Instruction ID: 7c35a8a7b4464b9b91a78c0655960c8b11da422b210bfbdc7632676104b0b87d
                          • Opcode Fuzzy Hash: 31b092787bb6a4f30555ec37cdbccb9f01d87d0a364808b82b8ef9c9ceb530f9
                          • Instruction Fuzzy Hash: 13217AB18003499FCB10DFAAD881AEEFBF5FF48320F10842EE558A7281C7349941CBA5
                          Function 071BDBA8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                          Download Yara Rule
                          APIs
                          • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 071BDC38
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MemoryProcessWrite
                          • String ID:
                          • API String ID: 3559483778-0
                          • Opcode ID: 79a44c5e829a98d3a4303c5bec7459bcdd5576d681edffa43bb066986393cbda
                          • Instruction ID: cfe72a1d3bbb2ae3c34360b352e782e9cc4f4e12cdebdb05ab96e54453fbf0ed
                          • Opcode Fuzzy Hash: 79a44c5e829a98d3a4303c5bec7459bcdd5576d681edffa43bb066986393cbda
                          • Instruction Fuzzy Hash: 5D2169B19003099FCB14DFAAC885BDEBBF5FF88310F10842DE958A7281C7789954CBA4
                          Function 00F1D5F8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                          Download Yara Rule
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F1D687
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 38248198ab120b4da35deaaa9805672316af5bf80b01ad7275ffbda22d6dae9c
                          • Instruction ID: b141742e76657c8c8b1c53a3434a22d9b8eba1c0ef100a8961214047b45640a1
                          • Opcode Fuzzy Hash: 38248198ab120b4da35deaaa9805672316af5bf80b01ad7275ffbda22d6dae9c
                          • Instruction Fuzzy Hash: B921E4B5900348DFDB10CFAAD584ADEBFF5EB48324F14842AE918A7351C374A954DF64
                          Function 071BD5D8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                          Download Yara Rule
                          APIs
                          • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 071BD656
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: ContextThreadWow64
                          • String ID:
                          • API String ID: 983334009-0
                          • Opcode ID: ce82288bdad5ad02c6c42e642ec867f605e94eb4b73d9f15f5ab1e434b9561eb
                          • Instruction ID: 87ad933ed9db0b3bd492af8cb319d978397a13ef5b2e88cb404747e3a9fc4b61
                          • Opcode Fuzzy Hash: ce82288bdad5ad02c6c42e642ec867f605e94eb4b73d9f15f5ab1e434b9561eb
                          • Instruction Fuzzy Hash: 472149B1D003099FDB14DFAAC4857EEBBF4EF88324F508429D459A7281CB789945CFA4
                          Function 071BDC98 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                          Download Yara Rule
                          APIs
                          • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 071BDD18
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MemoryProcessRead
                          • String ID:
                          • API String ID: 1726664587-0
                          • Opcode ID: 17b8e3726a813a9a29860310886b7d42d8f33221829a4c23ba11b5d33dbdc2be
                          • Instruction ID: 05746641215a2e317f828c5fa327037f7ae844e4f49a35f3ec02c5c5e079bee9
                          • Opcode Fuzzy Hash: 17b8e3726a813a9a29860310886b7d42d8f33221829a4c23ba11b5d33dbdc2be
                          • Instruction Fuzzy Hash: CD2139B19003499FCB10DFAAC845AEEFBF5FF48320F50842DE559A7281C7349945DBA4
                          Function 00F1D600 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                          Download Yara Rule
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F1D687
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: ee1e8df96cbaa18e8fe768794fd9774fd57fe591e193394b12205e38d3755b3c
                          • Instruction ID: 694d9b4a9de3543be85bd32cab71582dbe62c55c7e5cf26d32fe3dddc6c37cd3
                          • Opcode Fuzzy Hash: ee1e8df96cbaa18e8fe768794fd9774fd57fe591e193394b12205e38d3755b3c
                          • Instruction Fuzzy Hash: 7A21E4B5900308AFDB10CF9AD884ADEBBF4EB48320F14841AE918A3351C374A944DFA4
                          Function 071BDAE0 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                          Download Yara Rule
                          APIs
                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071BDB56
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 634d0131271552affa6559de16eabd1363161b6565d8ae72d6a47e083bd98716
                          • Instruction ID: b9768d9b4664bd0b415bac140e7d68c173c48e81c9b2d19521068f79a417f638
                          • Opcode Fuzzy Hash: 634d0131271552affa6559de16eabd1363161b6565d8ae72d6a47e083bd98716
                          • Instruction Fuzzy Hash: B21189B59002499FCB24DFAAC805AEFFFF5EF89320F108819E559A7251CB35A544CFA4
                          Function 00F1A0E8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F1AFF9,00000800,00000000,00000000), ref: 00F1B20A
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 6b9258c2e93ef8991eabe09a046f5d48c7e2008f94df32bca6c22c1d0724cede
                          • Instruction ID: 01fa43f6ae8a2d96de9dcc12eecb9e28d69aa5ec677d44695e9df8cc3a710ba8
                          • Opcode Fuzzy Hash: 6b9258c2e93ef8991eabe09a046f5d48c7e2008f94df32bca6c22c1d0724cede
                          • Instruction Fuzzy Hash: 821103B6C003499FDB10DF9AD848ADEFBF4EB88320F10842AE519A7201C775A944CFA4
                          Function 071BD522 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: ResumeThread
                          • String ID:
                          • API String ID: 947044025-0
                          • Opcode ID: 8fa0cc4eaa4aee940006f00ef7c599ea5e6c91619c6636be2f5a0c5812826c75
                          • Instruction ID: 26f17d96cc2e0bb8974e5d78a9974f781fe6fbce2c37c097536860ee6ed1438c
                          • Opcode Fuzzy Hash: 8fa0cc4eaa4aee940006f00ef7c599ea5e6c91619c6636be2f5a0c5812826c75
                          • Instruction Fuzzy Hash: D01176B59003498FCB24DFAAC4457EEFBF4EB88324F208819C059A7280CB35A940CBA4
                          Function 071BDAE8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                          Download Yara Rule
                          APIs
                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 071BDB56
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: AllocVirtual
                          • String ID:
                          • API String ID: 4275171209-0
                          • Opcode ID: 592e03b6f1f66ec6d7f7be11ebd69fd98094c5ccea3376c500f7d4acc4fedb48
                          • Instruction ID: 2c10aa01c202a06a6757db4c6037bcd9e7924c82ca8579fded9a1f22628359c8
                          • Opcode Fuzzy Hash: 592e03b6f1f66ec6d7f7be11ebd69fd98094c5ccea3376c500f7d4acc4fedb48
                          • Instruction Fuzzy Hash: EE1167B59002499FCB24DFAAC844ADFFFF5EF88320F108819E519A7250CB35A940CFA4
                          Function 00F1B198 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON
                          Download Yara Rule
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F1AFF9,00000800,00000000,00000000), ref: 00F1B20A
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 61f70a48ec141ec3d19530486eb501dc1f3c23d8915ba716d6dd4076b4e5a4c4
                          • Instruction ID: acc7c043862b57b9ab192aa53039845ded4bccd036494524e0d722a8a963c2eb
                          • Opcode Fuzzy Hash: 61f70a48ec141ec3d19530486eb501dc1f3c23d8915ba716d6dd4076b4e5a4c4
                          • Instruction Fuzzy Hash: 3C1114B6D00249DFDB10DF9AD448ADEFBF4EB88310F10842ED519A7600C375A944CFA5
                          Function 00FD1E38 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON
                          Download Yara Rule
                          APIs
                          • PostMessageW.USER32(?,00000010,00000000,?), ref: 00FD1E9D
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694463384.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_fd0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MessagePost
                          • String ID:
                          • API String ID: 410705778-0
                          • Opcode ID: e7937d05ca174b06d083a921e237be603caf1c6e8fa122bf3a6ea77d53af332c
                          • Instruction ID: cddd8f1af1db277e1733a40f4e6464df8a4d671c9a61c54628722891818ec52a
                          • Opcode Fuzzy Hash: e7937d05ca174b06d083a921e237be603caf1c6e8fa122bf3a6ea77d53af332c
                          • Instruction Fuzzy Hash: E91125B58003089FCB20DF9AD945BDEBBF8EB48320F14840AD958A7201C375A544CFA5
                          Function 071BD528 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                          Download Yara Rule
                          APIs
                          Memory Dump Source
                          • Source File: 00000007.00000002.1699944220.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_71b0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: ResumeThread
                          • String ID:
                          • API String ID: 947044025-0
                          • Opcode ID: d04377b162e0e8766ce9c857cb1d96b948df67bb49157575643af87d236c6369
                          • Instruction ID: 28b85016d86d0f37bda78190cd41b21aead4a113707470bcd3d981d4c72fe880
                          • Opcode Fuzzy Hash: d04377b162e0e8766ce9c857cb1d96b948df67bb49157575643af87d236c6369
                          • Instruction Fuzzy Hash: 691136B59003498FCB24DFAAC4457EEFBF5EF88324F208819D559A7280CB75A944CFA5
                          Function 00F1AF18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                          Download Yara Rule
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 00F1AF7E
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694232719.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_f10000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 3a4c0ff80356f32a89bac415da84b4d242ef5393e9a3d9aedd33ad650fb99025
                          • Instruction ID: 397193357c0ecfb29e96f63033436e392b04e263e744dd74f7566fbdb22be734
                          • Opcode Fuzzy Hash: 3a4c0ff80356f32a89bac415da84b4d242ef5393e9a3d9aedd33ad650fb99025
                          • Instruction Fuzzy Hash: 8411E0B5C013498FCB10DF9AC444ADEFBF4EF88324F10845AD419A7211C379A545CFA5
                          Function 00FD00B8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                          Download Yara Rule
                          APIs
                          • PostMessageW.USER32(?,00000010,00000000,?), ref: 00FD1E9D
                          Memory Dump Source
                          • Source File: 00000007.00000002.1694463384.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_fd0000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID: MessagePost
                          • String ID:
                          • API String ID: 410705778-0
                          • Opcode ID: 0ce9dc8ee7fefdf25f4425055e4fd8f8e0edb02038ea0f3c6b4056562e6e3073
                          • Instruction ID: 15347602de8d4e922a250017090e017da22b1164fcba9d93767e3e129495a93a
                          • Opcode Fuzzy Hash: 0ce9dc8ee7fefdf25f4425055e4fd8f8e0edb02038ea0f3c6b4056562e6e3073
                          • Instruction Fuzzy Hash: C41125B58003089FCB10DF8AC445BDEBBF8FB48320F10841AE918A7341C374A944CFA0
                          Function 00C3D4C4 Relevance: .1, Instructions: 75COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 44e4a066aee8b79af8fe8c849294fa6c6fafdb1f5319bc7c7f41437861a4b7aa
                          • Instruction ID: 318fb015cc7ff5ed362792028fafb047a99661e42e632ad3ad2640924b3e374b
                          • Opcode Fuzzy Hash: 44e4a066aee8b79af8fe8c849294fa6c6fafdb1f5319bc7c7f41437861a4b7aa
                          • Instruction Fuzzy Hash: 532137B1614240DFCB05DF14E9C0B26BF65FB98328F24C569E80B0B256C336D956DBA2
                          Function 00C3D3D8 Relevance: .1, Instructions: 75COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 75a577a39282b825c3c549bdcf13b2ea643f93a4f5a867c8871fb98b9f5c0735
                          • Instruction ID: 33939af03ce49050306dbcfffd5263eb388ff6177e08ba1c300599ceedf463c1
                          • Opcode Fuzzy Hash: 75a577a39282b825c3c549bdcf13b2ea643f93a4f5a867c8871fb98b9f5c0735
                          • Instruction Fuzzy Hash: 202128B1614204DFDB05DF14E9C4B16BF65FB94324F24C569E90B0B256C336E856CBA2
                          Function 00C4D1D4 Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693500589.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c4d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: dfaf27782528a6fdf083cfa18e2655c8afe87a980bfdcb475ca6506a84fbed27
                          • Instruction ID: 605956bbe174aefbd1af04fd9cf894c3dcf37060889f99d27926348f34c2dea5
                          • Opcode Fuzzy Hash: dfaf27782528a6fdf083cfa18e2655c8afe87a980bfdcb475ca6506a84fbed27
                          • Instruction Fuzzy Hash: A121F571604200EFDB15EF14D9C4B25BBA5FB94314F24C6ADE90B4B392C376DC46CA61
                          Function 00C4D01C Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693500589.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c4d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 757d9529954b04dbf4271a0b5598c9bc9d0c42196b7a38c235fdfa43262988e3
                          • Instruction ID: 1135196ec3c05a833cef2de255fa0963e1b2af5d0506ab5fd1690eb735891b7e
                          • Opcode Fuzzy Hash: 757d9529954b04dbf4271a0b5598c9bc9d0c42196b7a38c235fdfa43262988e3
                          • Instruction Fuzzy Hash: E021D075604200DFCB14EF14D9C4B26BBA5FB94314F24C9ADE80B4B386C33AD807CA61
                          Function 00C4D005 Relevance: .1, Instructions: 62COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693500589.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c4d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: ffd784acba1f0edcdccecd2dbafad7639f958be4754ea414cf2e6b36be5f19e3
                          • Instruction ID: 80bdc68645692e66bd0b0b89400025d4d7eb8813fb0627fe69c98c8b99937be8
                          • Opcode Fuzzy Hash: ffd784acba1f0edcdccecd2dbafad7639f958be4754ea414cf2e6b36be5f19e3
                          • Instruction Fuzzy Hash: 41218E755093808FCB02DF24D994715BF71FB46314F28C5EAD84A8B2A7C33A980ACB62
                          Function 00C3D3D3 Relevance: .1, Instructions: 56COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction ID: 06f0250f05701ac25499004ba6038733d4e61f1c4a02eef7cafddbe8c4953314
                          • Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction Fuzzy Hash: 4E110376504240CFCB02CF10E5C4B16BF72FB94324F24C2A9D80A0B256C33AE95ACBA1
                          Function 00C3D4BF Relevance: .1, Instructions: 56COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction ID: 9dc6e90e641b07ac9355ae1130e84e5a0c68bdeb7faf07ee7387297747bea65f
                          • Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
                          • Instruction Fuzzy Hash: 3A11E6B6504280CFCB16CF14D5C4B16BF72FB94324F24C6A9D84A0B656C336D95ACBA1
                          Function 00C4D1CF Relevance: .1, Instructions: 53COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693500589.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c4d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction ID: 0d63e8b8d6931c21289950cbecdbab02210df28f17e35120ad88902e1c201b19
                          • Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
                          • Instruction Fuzzy Hash: D111BB75904280DFCB12DF10C5C4B15BBB2FB84324F24C6ADD84A4B296C37AD84ACB61
                          Function 00C3D759 Relevance: .0, Instructions: 45COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 80a511ae1a03ee2c7bf6176ae99a9542497df3907ba670017533d24c4ddb224e
                          • Instruction ID: 05f8749271946c65f413293e456a2cd2ec108ce33f7484ffed947e5dfe61edf8
                          • Opcode Fuzzy Hash: 80a511ae1a03ee2c7bf6176ae99a9542497df3907ba670017533d24c4ddb224e
                          • Instruction Fuzzy Hash: E201DB710143449AE7205A16ECC4B66FFD8DF52725F18C85AED1E4B28AC7799840CBB1
                          Function 00C3D758 Relevance: .0, Instructions: 36COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 00000007.00000002.1693444538.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_7_2_c3d000_dgKDUvhlvCiVpa.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 9eae6f98e7eaf0bfb81c665721dc22c13d6cb8762e1ccb1b8155e6844543e4a6
                          • Instruction ID: 21e2170cf9d25ed8677e08bcd73ba606c14989c7360f2e8807f53651d23b88b1
                          • Opcode Fuzzy Hash: 9eae6f98e7eaf0bfb81c665721dc22c13d6cb8762e1ccb1b8155e6844543e4a6
                          • Instruction Fuzzy Hash: 6FF0F671004340AEE7208A06EC84B62FFE8EF51734F18C45AED190F28AC379AC40CBB1

                          Execution Graph

                          Execution Coverage:7.1%
                          Dynamic/Decrypted Code Coverage:100%
                          Signature Coverage:0%
                          Total number of Nodes:84
                          Total number of Limit Nodes:8
                          execution_graph 14112 155dd40 14113 155dd6e 14112->14113 14115 155dd97 14113->14115 14117 155de3f 14113->14117 14118 155d100 14113->14118 14116 155de3a KiUserCallbackDispatcher 14115->14116 14115->14117 14116->14117 14119 155d10b 14118->14119 14122 155d174 14119->14122 14121 155e355 14121->14115 14123 155d17f 14122->14123 14124 155e410 GetFocus 14123->14124 14125 155e409 14123->14125 14124->14125 14125->14121 14126 155d660 DuplicateHandle 14127 155d6f6 14126->14127 14128 1556e48 14131 1556a34 14128->14131 14130 1556e56 14132 1556a3f 14131->14132 14135 1556a84 14132->14135 14134 1556f7d 14134->14130 14136 1556a8f 14135->14136 14139 1556ab4 14136->14139 14138 155705a 14138->14134 14140 1556abf 14139->14140 14143 1556ae4 14140->14143 14142 155714d 14142->14138 14144 1556aef 14143->14144 14146 15583b3 14144->14146 14150 155ac58 14144->14150 14145 15583f1 14145->14142 14146->14145 14154 155cd50 14146->14154 14159 155cd40 14146->14159 14164 155ac90 14150->14164 14167 155ac80 14150->14167 14151 155ac6e 14151->14146 14155 155cd71 14154->14155 14156 155cd95 14155->14156 14191 155cf00 14155->14191 14195 155ceef 14155->14195 14156->14145 14161 155cd50 14159->14161 14160 155cd95 14160->14145 14161->14160 14162 155cf00 2 API calls 14161->14162 14163 155ceef 2 API calls 14161->14163 14162->14160 14163->14160 14171 155ad88 14164->14171 14165 155ac9f 14165->14151 14168 155ac90 14167->14168 14170 155ad88 2 API calls 14168->14170 14169 155ac9f 14169->14151 14170->14169 14172 155ad99 14171->14172 14174 155adbc 14171->14174 14172->14174 14179 155b010 14172->14179 14183 155b020 14172->14183 14173 155adb4 14173->14174 14175 155afc0 GetModuleHandleW 14173->14175 14174->14165 14176 155afed 14175->14176 14176->14165 14180 155b034 14179->14180 14182 155b059 14180->14182 14187 155a148 14180->14187 14182->14173 14184 155b034 14183->14184 14185 155b059 14184->14185 14186 155a148 LoadLibraryExW 14184->14186 14185->14173 14186->14185 14188 155b200 LoadLibraryExW 14187->14188 14190 155b279 14188->14190 14190->14182 14192 155cf0d 14191->14192 14193 155cf47 14192->14193 14199 155b760 14192->14199 14193->14156 14196 155cf00 14195->14196 14197 155cf47 14196->14197 14198 155b760 2 API calls 14196->14198 14197->14156 14198->14197 14201 155b76b 14199->14201 14200 155dc58 14201->14200 14203 155d064 14201->14203 14204 155d06f 14203->14204 14205 1556ae4 2 API calls 14204->14205 14206 155dcc7 14205->14206 14206->14200 14207 155d418 14208 155d45e GetCurrentProcess 14207->14208 14210 155d4b0 GetCurrentThread 14208->14210 14211 155d4a9 14208->14211 14212 155d4e6 14210->14212 14213 155d4ed GetCurrentProcess 14210->14213 14211->14210 14212->14213 14216 155d523 14213->14216 14214 155d54b GetCurrentThreadId 14215 155d57c 14214->14215 14216->14214

                          Executed Functions

                          Function 0155D408 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 526 155d408-155d4a7 GetCurrentProcess 530 155d4b0-155d4e4 GetCurrentThread 526->530 531 155d4a9-155d4af 526->531 532 155d4e6-155d4ec 530->532 533 155d4ed-155d521 GetCurrentProcess 530->533 531->530 532->533 535 155d523-155d529 533->535 536 155d52a-155d545 call 155d5e7 533->536 535->536 539 155d54b-155d57a GetCurrentThreadId 536->539 540 155d583-155d5e5 539->540 541 155d57c-155d582 539->541 541->540
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 0155D496
                          • GetCurrentThread.KERNEL32 ref: 0155D4D3
                          • GetCurrentProcess.KERNEL32 ref: 0155D510
                          • GetCurrentThreadId.KERNEL32 ref: 0155D569
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: 369003bd8f4cc1b42c708fb5cff83546e05d967c8aef7f6bc1cb3216d6490702
                          • Instruction ID: 85e4e187695fd4b16b80bfe49dcdce72f95997c85ec56ed91f5968f2139c5893
                          • Opcode Fuzzy Hash: 369003bd8f4cc1b42c708fb5cff83546e05d967c8aef7f6bc1cb3216d6490702
                          • Instruction Fuzzy Hash: 3C5156B19003098FDB44DFA9D588B9EBBF1FB48319F24845AD409AB390D735A984CF65
                          Function 0155D418 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 548 155d418-155d4a7 GetCurrentProcess 552 155d4b0-155d4e4 GetCurrentThread 548->552 553 155d4a9-155d4af 548->553 554 155d4e6-155d4ec 552->554 555 155d4ed-155d521 GetCurrentProcess 552->555 553->552 554->555 557 155d523-155d529 555->557 558 155d52a-155d545 call 155d5e7 555->558 557->558 561 155d54b-155d57a GetCurrentThreadId 558->561 562 155d583-155d5e5 561->562 563 155d57c-155d582 561->563 563->562
                          APIs
                          • GetCurrentProcess.KERNEL32 ref: 0155D496
                          • GetCurrentThread.KERNEL32 ref: 0155D4D3
                          • GetCurrentProcess.KERNEL32 ref: 0155D510
                          • GetCurrentThreadId.KERNEL32 ref: 0155D569
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: Current$ProcessThread
                          • String ID:
                          • API String ID: 2063062207-0
                          • Opcode ID: 304325f7ae44b60d1a71a123d1ce97026d838d0addb7199c4207b0341345d828
                          • Instruction ID: a35d51d3999ad5f6979003ddb5523503ed3490f8a15843e4ca06f22b8bddc5f1
                          • Opcode Fuzzy Hash: 304325f7ae44b60d1a71a123d1ce97026d838d0addb7199c4207b0341345d828
                          • Instruction Fuzzy Hash: ED5156B1900309CFDB54EFA9D548B9EBBF1FB48318F20845AE419AB390D774A984CF65
                          Function 0155AD88 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 570 155ad88-155ad97 571 155adc3-155adc7 570->571 572 155ad99-155ada6 call 155a0e4 570->572 573 155adc9-155add3 571->573 574 155addb-155ae1c 571->574 579 155adbc 572->579 580 155ada8 572->580 573->574 581 155ae1e-155ae26 574->581 582 155ae29-155ae37 574->582 579->571 625 155adae call 155b010 580->625 626 155adae call 155b020 580->626 581->582 583 155ae39-155ae3e 582->583 584 155ae5b-155ae5d 582->584 587 155ae40-155ae47 call 155a0f0 583->587 588 155ae49 583->588 586 155ae60-155ae67 584->586 585 155adb4-155adb6 585->579 589 155aef8-155afb8 585->589 590 155ae74-155ae7b 586->590 591 155ae69-155ae71 586->591 593 155ae4b-155ae59 587->593 588->593 620 155afc0-155afeb GetModuleHandleW 589->620 621 155afba-155afbd 589->621 594 155ae7d-155ae85 590->594 595 155ae88-155ae91 call 155a100 590->595 591->590 593->586 594->595 601 155ae93-155ae9b 595->601 602 155ae9e-155aea3 595->602 601->602 603 155aea5-155aeac 602->603 604 155aec1-155aece 602->604 603->604 606 155aeae-155aebe call 155a110 call 155a120 603->606 610 155aef1-155aef7 604->610 611 155aed0-155aeee 604->611 606->604 611->610 622 155aff4-155b008 620->622 623 155afed-155aff3 620->623 621->620 623->622 625->585 626->585
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0155AFDE
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 306484bf8b8551b8ad617af593788faaec2c9232a874000ba3a79053ce58270f
                          • Instruction ID: 99b828fa94cdc8c65a67f408b398f7b4adab765694e6969499710e80b8d7a514
                          • Opcode Fuzzy Hash: 306484bf8b8551b8ad617af593788faaec2c9232a874000ba3a79053ce58270f
                          • Instruction Fuzzy Hash: 5A713870A00B058FDB64DF29D46475ABBF1FF88304F008A2ED99ADBA50DB75E945CB90
                          Function 0155D658 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 627 155d658-155d65a 628 155d660-155d6f4 DuplicateHandle 627->628 629 155d6f6-155d6fc 628->629 630 155d6fd-155d71a 628->630 629->630
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D6E7
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 02f2b1d698ff7a0b0b48395242ce0398da296a3a7bd057e68fb6ea655b0d5a96
                          • Instruction ID: 3e649cf47335605a5449e0dece513d2e830f21555d241ddf98a84687bf2972fc
                          • Opcode Fuzzy Hash: 02f2b1d698ff7a0b0b48395242ce0398da296a3a7bd057e68fb6ea655b0d5a96
                          • Instruction Fuzzy Hash: 1E21E3B59002499FDB10CFAAD885ADEBFF9FB48320F14841AE918A7350C775A954CFA4
                          Function 0155D660 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 633 155d660-155d6f4 DuplicateHandle 634 155d6f6-155d6fc 633->634 635 155d6fd-155d71a 633->635 634->635
                          APIs
                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D6E7
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: DuplicateHandle
                          • String ID:
                          • API String ID: 3793708945-0
                          • Opcode ID: 06ebf83ebf1a670d760066169773e2e96435d9aea5bbbdd2ed404f4ec69fe492
                          • Instruction ID: 347e0ae8adfe00b29611b1c6c85069d1cce57771b5348e03274ba9be6e264066
                          • Opcode Fuzzy Hash: 06ebf83ebf1a670d760066169773e2e96435d9aea5bbbdd2ed404f4ec69fe492
                          • Instruction Fuzzy Hash: 0921E0B59002499FDB10CFAAD884ADEBFF8FB48320F14841AE918A7350C374A944CFA4
                          Function 0155A148 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 638 155a148-155b240 640 155b242-155b245 638->640 641 155b248-155b277 LoadLibraryExW 638->641 640->641 642 155b280-155b29d 641->642 643 155b279-155b27f 641->643 643->642
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0155B059,00000800,00000000,00000000), ref: 0155B26A
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 42cb8b24937b1bc5af7f3f3cda55134b600504626ccb3474da795c57a1b71b07
                          • Instruction ID: 612c9961a73f3f3fb33c10d2e82ca53100d54e06ca9091caa3ba71d75a79e4c5
                          • Opcode Fuzzy Hash: 42cb8b24937b1bc5af7f3f3cda55134b600504626ccb3474da795c57a1b71b07
                          • Instruction Fuzzy Hash: 291114B6C003498FDB10DF9AC448ADEFBF5FB48310F10842AE919AB200C775A945CFA5
                          Function 0155B1F8 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 646 155b1f8-155b240 648 155b242-155b245 646->648 649 155b248-155b277 LoadLibraryExW 646->649 648->649 650 155b280-155b29d 649->650 651 155b279-155b27f 649->651 651->650
                          APIs
                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0155B059,00000800,00000000,00000000), ref: 0155B26A
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: LibraryLoad
                          • String ID:
                          • API String ID: 1029625771-0
                          • Opcode ID: 41fe42719b5dbeeb8df6cb22c9f10e3cbc45c70c031fde59294380f005768eb0
                          • Instruction ID: 2af24d5fac61fe532438c6857bd905ae651c5cb3de01bf4ef5d3fe8231681e46
                          • Opcode Fuzzy Hash: 41fe42719b5dbeeb8df6cb22c9f10e3cbc45c70c031fde59294380f005768eb0
                          • Instruction Fuzzy Hash: DA1123B6C003098FDB10CF9AC488ADEFBF5FB88310F10852AE959AB200C775A545CFA5
                          Function 0155AF78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                          Download Yara Rule

                          Control-flow Graph

                          • Executed
                          • Not Executed
                          control_flow_graph 654 155af78-155afb8 655 155afc0-155afeb GetModuleHandleW 654->655 656 155afba-155afbd 654->656 657 155aff4-155b008 655->657 658 155afed-155aff3 655->658 656->655 658->657
                          APIs
                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0155AFDE
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735844020.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_1550000_MSBuild.jbxd
                          Similarity
                          • API ID: HandleModule
                          • String ID:
                          • API String ID: 4139908857-0
                          • Opcode ID: 6bd82f5e51993600a33501602e44d462f8f300329f7792ddfe6a2839744217e4
                          • Instruction ID: e2add44f921e4ea83783ec6586b2ccf5f61edc2f3dc1647d2182ba7b16062d4c
                          • Opcode Fuzzy Hash: 6bd82f5e51993600a33501602e44d462f8f300329f7792ddfe6a2839744217e4
                          • Instruction Fuzzy Hash: 991110B5C003498FDB10CF9AC444ADEFBF4EF88324F10852AD929A7240C379A545CFA1
                          Function 0124D01C Relevance: .1, Instructions: 72COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735365403.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_124d000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: e2d63cfd2f2b9917c9650fec84a6aa4a016629739062760a6e825e87ddf3c448
                          • Instruction ID: 05af787c2ab8fd47948c43d39025d811c8585a0ae22ab02e143a2926c88391b0
                          • Opcode Fuzzy Hash: e2d63cfd2f2b9917c9650fec84a6aa4a016629739062760a6e825e87ddf3c448
                          • Instruction Fuzzy Hash: 64212575614208DFCB19DF58D8C4B16BBA5FBA4314F20C96DD90A0B342C37AD407CA61
                          Function 0124D006 Relevance: .1, Instructions: 63COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000B.00000002.1735365403.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_11_2_124d000_MSBuild.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 29e9b0971248212cd418e4598a04f537456ff03b0e411d730e12232672f44b14
                          • Instruction ID: da02ad86e5ca8702c99483095b7df661be69bb891367459996344cbdcb935043
                          • Opcode Fuzzy Hash: 29e9b0971248212cd418e4598a04f537456ff03b0e411d730e12232672f44b14
                          • Instruction Fuzzy Hash: D8219F755083849FCB07CF64D994B11BF71EB56314F28C5EAD9498F2A7C33A980ACB62

                          Executed Functions

                          Function 00E52B90 Relevance: 2.0, Instructions: 2013COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 4b9ad88b859e05d7b0fee28569bf9bc5ac60ef0abbe2d4210752ed647fa6cea5
                          • Instruction ID: 556115a68063cf17b3ec3261735dbeea7e5ff25c5dceb51a4a09d865e760ef98
                          • Opcode Fuzzy Hash: 4b9ad88b859e05d7b0fee28569bf9bc5ac60ef0abbe2d4210752ed647fa6cea5
                          • Instruction Fuzzy Hash: 3B038B30A0071A9FDB11EF64CC44BA9B7B6FF89700F118695E6087B691DBB1AEC5CB50
                          Function 00E55A49 Relevance: 1.7, Strings: 1, Instructions: 436COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: $^q
                          • API String ID: 0-388095546
                          • Opcode ID: 623d762330d57285ab65257f62f72902be1fa2c6e46d6d928a832965b09a6d25
                          • Instruction ID: 70108e2978d3c6846f56932e8a20e7b29b3fe862a8b085643387d3bf1c03dd82
                          • Opcode Fuzzy Hash: 623d762330d57285ab65257f62f72902be1fa2c6e46d6d928a832965b09a6d25
                          • Instruction Fuzzy Hash: B6F1C631B007059FDB14DF64C954BAEB7F2BF8870AF148829D909AB295DB71EC45CB50
                          Function 00E517C8 Relevance: 3.9, Strings: 3, Instructions: 157COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: (bq$D@$Hbq
                          • API String ID: 0-913811383
                          • Opcode ID: 646ca4989342cbe02173c0b3415f2e7607b51ed73c175100328b997b40f5abd9
                          • Instruction ID: 20587eedcf5ca2e05543b8a26a997560cd81b480d90f21f51ed7cfd30005eb56
                          • Opcode Fuzzy Hash: 646ca4989342cbe02173c0b3415f2e7607b51ed73c175100328b997b40f5abd9
                          • Instruction Fuzzy Hash: 2F51BE71E002489FCB08DF7998146FEBBB2EFC5311F1484BAD559E7291EB344A0ACB91
                          Function 00E520C8 Relevance: 2.6, Strings: 2, Instructions: 126COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: $^q$$^q
                          • API String ID: 0-355816377
                          • Opcode ID: 40c0606906ef5733934190d99527c21a8278971109ea15c464077fe21017f91a
                          • Instruction ID: 5a231faa4c21f6b35e978875eac6306223bc3dc8e646722cf6f716d839e78bb0
                          • Opcode Fuzzy Hash: 40c0606906ef5733934190d99527c21a8278971109ea15c464077fe21017f91a
                          • Instruction Fuzzy Hash: 0D41E3356002098FC705EF29D84496E77F2FF85311715C56AE609DB364EF70AD49CBA0
                          Function 00E55071 Relevance: 1.7, Strings: 1, Instructions: 420COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: `Q^q
                          • API String ID: 0-1948671464
                          • Opcode ID: 0a80235a8d0ffd439144f7225b7a016c72ddc13984eaa5977f79f9060c04156d
                          • Instruction ID: 03a8a8695c46929a0551058312a691ee1ec355ddf017545e70455f08a5e4ab90
                          • Opcode Fuzzy Hash: 0a80235a8d0ffd439144f7225b7a016c72ddc13984eaa5977f79f9060c04156d
                          • Instruction Fuzzy Hash: AB21F332A042048FDB14DF64C8656AD7BF1AF89349F151869D806F7294EBB0AC49CBA1
                          Function 00E50848 Relevance: 1.4, Strings: 1, Instructions: 116COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: 4'^q
                          • API String ID: 0-1614139903
                          • Opcode ID: 86c0cf93a9f9bc5cdebd1567034db5d0f89dc84186af9103edc6d852fff83efd
                          • Instruction ID: b6431d170976f8e40cfc9a4aa3883e629857e2533e7ab6ea7b865b3a1037c05d
                          • Opcode Fuzzy Hash: 86c0cf93a9f9bc5cdebd1567034db5d0f89dc84186af9103edc6d852fff83efd
                          • Instruction Fuzzy Hash: EC41C270A002189FDB01EFB8E5447AD7BF1EF84305F108825E109AB355EF749D49CBA1
                          Function 00E51F70 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: tP^q
                          • API String ID: 0-2862610199
                          • Opcode ID: b7c1dbed19f787a4b43108831fba93caa594885889b42b90614d49acb6df2062
                          • Instruction ID: ef832f5a670d9f064333d525a1bb8e18bd35af7f507a6b3dbfad266dcbc5b8d0
                          • Opcode Fuzzy Hash: b7c1dbed19f787a4b43108831fba93caa594885889b42b90614d49acb6df2062
                          • Instruction Fuzzy Hash: 04215A74B002158FCB48EF78C44896EB7B2AF4970972148A9E90ADF3A1DB35DC42CB91
                          Function 00E51F80 Relevance: 1.3, Strings: 1, Instructions: 69COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: tP^q
                          • API String ID: 0-2862610199
                          • Opcode ID: 8f242b5f97c09c5ed51db22125e7595047179fbbf0e1686fbeffde4bcd2720ab
                          • Instruction ID: fd0468316b342baa32902e63efe3649b69517e008ae63b36419c958990e6e76d
                          • Opcode Fuzzy Hash: 8f242b5f97c09c5ed51db22125e7595047179fbbf0e1686fbeffde4bcd2720ab
                          • Instruction Fuzzy Hash: 8F213774B002158FCB48EF78C45896EB7F2AF4971572148A9E90ADB3B1DA35DC42CB91
                          Function 00E55350 Relevance: 1.3, Strings: 1, Instructions: 56COMMON
                          Download Yara Rule
                          Strings
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID: `Q^q
                          • API String ID: 0-1948671464
                          • Opcode ID: 7cf057b8bda5f96808d92d3215776832a921391e8a8550fd386b3f14f896f39f
                          • Instruction ID: 9ed6111a68854f218f8c98ef9aae111c16688b68fdcf532443f5a0ad023a5a7d
                          • Opcode Fuzzy Hash: 7cf057b8bda5f96808d92d3215776832a921391e8a8550fd386b3f14f896f39f
                          • Instruction Fuzzy Hash: FB112271A102098BDB14DF64C8216BE7BF2BF88309F104828D806B7384EF74AD48CBB1
                          Function 00E54C70 Relevance: .2, Instructions: 225COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: b3a57daddd6f50a1ab1c68ea5a72089805ecdf578e753ab985812bd70f50cac2
                          • Instruction ID: 231a3371bd05944aa71d2a9e687e5b37c2e76a36ce6d56a6ac14ba9807ab4bb4
                          • Opcode Fuzzy Hash: b3a57daddd6f50a1ab1c68ea5a72089805ecdf578e753ab985812bd70f50cac2
                          • Instruction Fuzzy Hash: 6AA14A70200605CFCB15DF19C988A69BBF2FF45305B46C9A9D4499F6A6DB30FD89CB90
                          Function 00E51062 Relevance: .2, Instructions: 220COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: d138041dc05757dcfc10d9e13e470dc0fb3e8776abc3ccd140988764c70154ba
                          • Instruction ID: 858dcf634519ade6aa03e9843cb35c9902323052ff3537d145b5c65fa4a9ed6a
                          • Opcode Fuzzy Hash: d138041dc05757dcfc10d9e13e470dc0fb3e8776abc3ccd140988764c70154ba
                          • Instruction Fuzzy Hash: 78918F71D002089FCB05DFE5D944AEEBBFABF88304F14852AE505EB264DB75994ACF60
                          Function 00E55E30 Relevance: .2, Instructions: 182COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 6e49b99c4750d80aa10d72fccd12fc15a02639f6c43c9ef0257de1fb332ca9d8
                          • Instruction ID: fc8ee77ea8d8b50809d7671db74c31c3b042091ddaba83e339888ccb692fcd39
                          • Opcode Fuzzy Hash: 6e49b99c4750d80aa10d72fccd12fc15a02639f6c43c9ef0257de1fb332ca9d8
                          • Instruction Fuzzy Hash: 9761AD31B002049FCB04DF69C894BAEBBF2BF88715F148465E905EB3A1DB71AC49CB60
                          Function 00E50ED7 Relevance: .1, Instructions: 95COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 57a275d9365cffb82e4ad2f16f68eb921bb1725ba6c22393f84a719e3a42c32d
                          • Instruction ID: b5224e312c9f9270ede7a43506d18fa5123c11d576e39cdd59beca068298d32d
                          • Opcode Fuzzy Hash: 57a275d9365cffb82e4ad2f16f68eb921bb1725ba6c22393f84a719e3a42c32d
                          • Instruction Fuzzy Hash: 7821905382E3808FEB1646281C562A03F90D7723577752ED7E999B7193E580480DC3B2
                          Function 00E56068 Relevance: .1, Instructions: 57COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 34752495c0a8bf69be45c2d944a88a4ba1ef6aa955fe890a5d8a0c1f9583bfe4
                          • Instruction ID: d20da1a96e913d2b8f1f0010deead3f8effc16488eeef5f6ae93e742c4b13d2e
                          • Opcode Fuzzy Hash: 34752495c0a8bf69be45c2d944a88a4ba1ef6aa955fe890a5d8a0c1f9583bfe4
                          • Instruction Fuzzy Hash: 99112070E043489FCB21DF3D9844BAE7FB1EFC5319F1004AEE508AB282EB3259098790
                          Function 00E55620 Relevance: .0, Instructions: 48COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: b3ca73ce3f05d8dd174e534b8d40473d18382be0a6fdcbc86b0d67b6b84daa83
                          • Instruction ID: 6962dd8d74f6c7128fb0a3fc614174aa769c1277ab165fcc77dcd2abe9d764be
                          • Opcode Fuzzy Hash: b3ca73ce3f05d8dd174e534b8d40473d18382be0a6fdcbc86b0d67b6b84daa83
                          • Instruction Fuzzy Hash: 0501D871B002308FC7159F3DE8548157BE99F8961631600A5E805DB335CE71EC0587E1
                          Function 00E55630 Relevance: .0, Instructions: 42COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: b1fa452b6e11cfae8935db578a932ce888ea462b65bda069c4cf041832a683dd
                          • Instruction ID: fe9950ffe7f5c8f1b92371fde2f4c0f57ef3dcb58e2fa0370b030e6ff3c7ee81
                          • Opcode Fuzzy Hash: b1fa452b6e11cfae8935db578a932ce888ea462b65bda069c4cf041832a683dd
                          • Instruction Fuzzy Hash: 43F06876B101308FC758AF3DE55481A77E99F89B6631501B9E809DB324DE71EC018BE1
                          Function 00E55541 Relevance: .0, Instructions: 36COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 8ff006911a12aa767a5ef6d0b122b6239947a24d12ac9badecd952449bdae283
                          • Instruction ID: 00e5d905ae1d006563d1a8af4a06129d0b3b9bbd5a6051e85e63481155c4f4b5
                          • Opcode Fuzzy Hash: 8ff006911a12aa767a5ef6d0b122b6239947a24d12ac9badecd952449bdae283
                          • Instruction Fuzzy Hash: D2F0E9353043149FC305DB3ADC5488A7BA6EFCE321758847AE509D7361DA76AC4AC7A1
                          Function 00E50AA8 Relevance: .0, Instructions: 35COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: d5b8a5cc9803cd1329656896b3bc8b5b1883ec31a7d0a097dc9fa0636e99024c
                          • Instruction ID: 7fb35cc3154984d1a59da803b7a6f7674b8dfaa606c2f26841ab8ca8eaf9b212
                          • Opcode Fuzzy Hash: d5b8a5cc9803cd1329656896b3bc8b5b1883ec31a7d0a097dc9fa0636e99024c
                          • Instruction Fuzzy Hash: 61F0F6357003014FCB0867B1E96876B3355A780789F040838A906D73D4EEAACC88C790
                          Function 00E54F3C Relevance: .0, Instructions: 31COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: b9c6282e87204d908113cbe21b554df52d68bd1e9c726a757c860d1e45577f41
                          • Instruction ID: a7823e45d7c457191a0d29b79b71590afa228063c1361bf2619f5c0e7d10863e
                          • Opcode Fuzzy Hash: b9c6282e87204d908113cbe21b554df52d68bd1e9c726a757c860d1e45577f41
                          • Instruction Fuzzy Hash: 48F024B2E043049FDB04CBA898451AD7BB4EFC8305B04819BE615A7264EF740649CB40
                          Function 00E55550 Relevance: .0, Instructions: 27COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 9782a692aa4e36f47513ca6e641c1e0be4f0f5622fbcde7967548f9031526ec0
                          • Instruction ID: 74de6e836180ebad643eaf11613e3abb789cf23ef764dff3b5863c040c959e75
                          • Opcode Fuzzy Hash: 9782a692aa4e36f47513ca6e641c1e0be4f0f5622fbcde7967548f9031526ec0
                          • Instruction Fuzzy Hash: 1FE09B313003049FC304EB3AE84485AB7AAFBC93517148139E50EC3354DE755C4AC761
                          Function 00E513B0 Relevance: .0, Instructions: 27COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: bb9c12e1dc00f5127a196bb5900c342691494f9aaed002b212b69a31af52e818
                          • Instruction ID: 14b4c450ec0a409abf475054ebf9833a8c166e69b91679f7d4af06e50923e6a8
                          • Opcode Fuzzy Hash: bb9c12e1dc00f5127a196bb5900c342691494f9aaed002b212b69a31af52e818
                          • Instruction Fuzzy Hash: 36F0F478640205CFC705EF64D258A6CBBB1EF49309F2048A9E41AAB3A1DBB99845CF01
                          Function 00E50F28 Relevance: .0, Instructions: 26COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: 8030850730a117678412c784f6e9ffc07dad0907c2e06e2e1230d23a18174ad9
                          • Instruction ID: 7fb7c283dda6b3735798c9a40b25afefeeee62a34bc405a96ed6dacc3ee229dc
                          • Opcode Fuzzy Hash: 8030850730a117678412c784f6e9ffc07dad0907c2e06e2e1230d23a18174ad9
                          • Instruction Fuzzy Hash: DCE0927090630CDFCB41DF74DE01958BBF4EF5634572445EAD808EB251DA316E05CBA1
                          Function 00E50F38 Relevance: .0, Instructions: 16COMMON
                          Download Yara Rule
                          Memory Dump Source
                          • Source File: 0000000C.00000002.1799456874.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false
                          Joe Sandbox IDA Plugin
                          • Snapshot File: hcaresult_12_2_e50000_dnshost.jbxd
                          Similarity
                          • API ID:
                          • String ID:
                          • API String ID:
                          • Opcode ID: a3a95e74dd5f93af99f03b40a8761b42390b7845bd43cf7c50a9fd545c497457
                          • Instruction ID: 618ff8d3212d5baf82dbab75ee204ffd5962afbe9e1da82745082227b3fcd349
                          • Opcode Fuzzy Hash: a3a95e74dd5f93af99f03b40a8761b42390b7845bd43cf7c50a9fd545c497457
                          • Instruction Fuzzy Hash: 42D01770A0020DEFCB00EFA8EE0195DB7F9EB44205B1085A9A408E7241EA716F009B91