Edit tour

Windows Analysis Report
LisectAVT_2403002B_286.exe

Overview

General Information

Sample name:	LisectAVT_2403002B_286.exe
Analysis ID:	1481863
MD5:	feffd73ddba802eae61e964e78ef7e95
SHA1:	e727e9d97f34c4e0903f4c9188883347addae2e8
SHA256:	31fc993f42d691c16489d7e3e101f64362c585dd29cf40aad479dd2f53103b4c
Tags:	exe
Infos:

Detection

Score:	69
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to inject threads in other processes

Deletes itself after installation

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sigma detected: Dot net compiler compiles file from suspicious location

Tries to detect virtualization through RDTSC time measurements

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002B_286.exe (PID: 5532 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" MD5: FEFFD73DDBA802EAE61E964E78EF7E95)

LisectAVT_2403002B_286_Update.exe (PID: 4756 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe" MD5: BF04325C66CFA445F487A5F799990189)

LisectAVT_2403002B_286.exe (PID: 3688 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe" MD5: BF04325C66CFA445F487A5F799990189)

LisectAVT_2403002B_286_Update.exe (PID: 5136 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe" MD5: F72D84B6D1683DEE10A997DEDB825D7D)

LisectAVT_2403002B_286.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe" MD5: F72D84B6D1683DEE10A997DEDB825D7D)

csc.exe (PID: 3848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 5524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 2676 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3017.tmp" "c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 4204 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1888 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6262.tmp" "c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csc.exe (PID: 6828 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6208 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D8E.tmp" "c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2887278083.00000000099B0000.00000004.10000000.00040000.00000000.sdmp	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmp	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
0000000A.00000002.2831351105.0000000009990000.00000004.10000000.00040000.00000000.sdmp	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.LisectAVT_2403002B_286.exe.3ba9550.6.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
10.2.LisectAVT_2403002B_286.exe.8540000.27.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x1d58:$s1: DNGuard Runtime library 0x1e78:$s1: DNGuard Runtime library 0x1ee7:$s1: DNGuard Runtime library 0x1f5d:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.9990000.29.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
10.2.LisectAVT_2403002B_286.exe.815ef4c.26.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
13.3.LisectAVT_2403002B_286.exe.7eb016c.2.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
10.3.LisectAVT_2403002B_286.exe.7eb4170.0.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
13.3.LisectAVT_2403002B_286.exe.7eb6170.0.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.95959c8.28.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
9.3.LisectAVT_2403002B_286_Update.exe.7ebb170.1.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.8110000.23.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0xd2d2c:$s1: DNGuard Runtime library 0xd2e50:$s1: DNGuard Runtime library 0xd2ebf:$s1: DNGuard Runtime library 0xd2f35:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
9.3.LisectAVT_2403002B_286_Update.exe.7eb516c.0.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.9990000.29.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
9.2.LisectAVT_2403002B_286_Update.exe.8164f50.16.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.3ba9550.6.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
11.3.LisectAVT_2403002B_286_Update.exe.7eba16c.0.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
11.2.LisectAVT_2403002B_286_Update.exe.815ef4c.16.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
11.3.LisectAVT_2403002B_286_Update.exe.7ec0170.2.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
10.3.LisectAVT_2403002B_286.exe.7eb9974.1.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0xd2d2c:$s1: DNGuard Runtime library 0xd2e50:$s1: DNGuard Runtime library 0xd2ebf:$s1: DNGuard Runtime library 0xd2f35:$s2: [=]This application is expired ![=]
11.3.LisectAVT_2403002B_286_Update.exe.7ec5974.1.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
10.3.LisectAVT_2403002B_286.exe.7eae16c.2.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.95959c8.28.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
11.2.LisectAVT_2403002B_286_Update.exe.816a754.15.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.815ef4c.15.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x85be0:$s1: DNGuard Runtime library 0x85d04:$s1: DNGuard Runtime library 0x85d73:$s1: DNGuard Runtime library 0x85de9:$s2: [=]This application is expired ![=]
0.3.LisectAVT_2403002B_286.exe.7f5fe60.0.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x6bdf8:$s1: DNGuard Runtime library 0x6bf1c:$s1: DNGuard Runtime library 0x6bf8b:$s1: DNGuard Runtime library 0x6c001:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0xd2d2c:$s1: DNGuard Runtime library 0xd2e50:$s1: DNGuard Runtime library 0xd2ebf:$s1: DNGuard Runtime library 0xd2f35:$s2: [=]This application is expired ![=]
10.2.LisectAVT_2403002B_286.exe.8164f50.25.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
9.3.LisectAVT_2403002B_286_Update.exe.7ec0974.2.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x1d58:$s1: DNGuard Runtime library 0x1e78:$s1: DNGuard Runtime library 0x1ee7:$s1: DNGuard Runtime library 0x1f5d:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x1d58:$s1: DNGuard Runtime library 0x1e78:$s1: DNGuard Runtime library 0x1ee7:$s1: DNGuard Runtime library 0x1f5d:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
13.3.LisectAVT_2403002B_286.exe.7ebb974.1.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x19ed1:$s1: DNGuard Runtime library 0x19ffd:$s1: DNGuard Runtime library 0x1a06c:$s1: DNGuard Runtime library 0x1a0e2:$s2: [=]This application is expired ![=] 0x18dc9:$s3: DNGuard.Runtime 0x19213:$s3: DNGuard.Runtime 0x19f6d:$s3: DNGuard.Runtime 0x1a7e3:$s3: DNGuard.Runtime 0x1b408:$s3: DNGuard.Runtime 0x1b4e8:$s3: DNGuard.Runtime 0x1b530:$s3: DNGuard.Runtime 0x1871e:$s4: EnableHVM 0x18af2:$s4: EnableHVM 0x197e0:$s4: EnableHVM 0x18ae6:$s5: DNGuard.SDK
10.2.LisectAVT_2403002B_286.exe.816a754.24.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7a3d8:$s1: DNGuard Runtime library 0x7a4fc:$s1: DNGuard Runtime library 0x7a56b:$s1: DNGuard Runtime library 0x7a5e1:$s2: [=]This application is expired ![=]
9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x180d1:$s1: DNGuard Runtime library 0x181fd:$s1: DNGuard Runtime library 0x1826c:$s1: DNGuard Runtime library 0x182e2:$s2: [=]This application is expired ![=] 0x16fc9:$s3: DNGuard.Runtime 0x17413:$s3: DNGuard.Runtime 0x1816d:$s3: DNGuard.Runtime 0x189e3:$s3: DNGuard.Runtime 0x19608:$s3: DNGuard.Runtime 0x196e8:$s3: DNGuard.Runtime 0x19730:$s3: DNGuard.Runtime 0x1691e:$s4: EnableHVM 0x16cf2:$s4: EnableHVM 0x179e0:$s4: EnableHVM 0x16ce6:$s5: DNGuard.SDK
11.2.LisectAVT_2403002B_286_Update.exe.8164f50.14.raw.unpack	INDICATOR_EXE_Packed_DNGuard	Detects executables packed with DNGuard	ditekSHen	0x7fbdc:$s1: DNGuard Runtime library 0x7fd00:$s1: DNGuard Runtime library 0x7fd6f:$s1: DNGuard Runtime library 0x7fde5:$s2: [=]This application is expired ![=]
Click to see the 41 entries

Sigma Signatures

System Summary

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe, ParentProcessId: 6472, ParentProcessName: LisectAVT_2403002B_286.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", ProcessId: 3848, ProcessName: csc.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe, ProcessId: 6472, TargetFilename: C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe, ParentProcessId: 6472, ParentProcessName: LisectAVT_2403002B_286.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline", ProcessId: 3848, ProcessName: csc.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:16:59.746186+0200
SID:	2022930
Source Port:	443
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:17:25.307313+0200
SID:	2012510
Source Port:	443
Destination Port:	49749
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:17:38.371108+0200
SID:	2022930
Source Port:	443
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:17:25.507948+0200
SID:	2012510
Source Port:	443
Destination Port:	49749
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.176.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:18:52.480080+0200
SID:	2012510
Source Port:	443
Destination Port:	49815
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.65.238 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:18:52.299166+0200
SID:	2012510
Source Port:	443
Destination Port:	49818
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.80.66 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:18:39.999941+0200
SID:	2012510
Source Port:	443
Destination Port:	49800
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.194 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T15:17:25.300914+0200
SID:	2012510
Source Port:	443
Destination Port:	49749
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Avira: detection malicious, Label: HEUR/AGEN.1315051
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Avira: detection malicious, Label: HEUR/AGEN.1315051

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002B_286.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION LisectAVT_2403002B_286.exe

Jump to behavior

Source: LisectAVT_2403002B_286.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 185.199.108.153:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.105.38.12:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.20:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 163.181.92.223:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.197.91.145:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.166.250.135:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49811 version: TLS 1.2

Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\obj\win32\release_full\boxedappsdkthunk\BoxedAppSDKThunk.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Microsoft.Web.WebView2.Core.dll.13.dr
Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\bin\release_full\bxsdk32.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: V:\builds\BoxedApp\files\8CC2254F\src\BoxedApp\bxsdk\obj\x86\Release_Full\BoxedAppSDK_AppDomainManager.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.WinForms.pdb source: Microsoft.Web.WebView2.WinForms.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb< source: Microsoft.Web.WebView2.Core.dll.13.dr
Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\obj\win32\release_full\tlssupport\TLSSupport.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\Code\Others\SuWar3Tools\SuLibrary\obj\Release\SuLibrary.pdb source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2773345003.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000003.2697372563.0000000007E68000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2771084886.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2820026041.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2822734108.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000003.2738044377.0000000007E61000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882566524.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000003.2807536228.0000000007E6D000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2881628340.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000D.00000003.2856843634.0000000007E63000.00000004.00000020.00020000.00000000.sdmp, SuLibrary.dll.13.dr

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04E9ABB0 GetCurrentProcess,FindFirstFileW,VirtualProtect,lstrcmpiW,lstrcmpiW,lstrcmpiW,CreateFileW,GetFileSize,GetLastError,ReadFile,AddFontMemResourceEx,GetLastError,GetLastError,CloseHandle,FindNextFileW,FindClose,

9_2_04E9ABB0

Source: global traffic	HTTP traffic detected: GET /war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c-2292-4cc4-8c71-78b44a037995/items?path=/README.md HTTP/1.1Host: dev.azure.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools.github.io/raw/master/docs/README.md HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /README.md HTTP/1.1Host: war3tools.github.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /project/war3tools/README.md?viasf=1 HTTP/1.1Host: master.dl.sourceforge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools.github.io/master/docs/README.md HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /README.md HTTP/1.1Host: war3tools.suyx.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=?download=SuWar3Tools.zip&randomtime=638574961174603590 HTTP/1.1Host: nim-nosdn.netease.imCache-Control: no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1Host: codeberg.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1Host: gitea.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/banner.html HTTP/1.1Host: war3tools.gitlab.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/banner.html HTTP/1.1Host: war3tools.gitlab.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.199.108.153 185.199.108.153
Source: Joe Sandbox View	IP Address: 185.199.108.153 185.199.108.153
Source: Joe Sandbox View	IP Address: 140.82.121.4 140.82.121.4

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Accept-Encoding: gzip, deflateHost: war3tools.suyx.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: war3tools.suyx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://war3tools.suyx.net/ad/header.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __gads=ID=3db76bb96bc61d49:T=1721913518:RT=1721913518:S=ALNI_MZbG8Djp3HAW8YyEyDeBQyV0rWmGw; __gpi=UID=00000eb054b56a23:T=1721913518:RT=1721913518:S=ALNI_MZJu1M0eTihEZq4YzRBr59EBWirJA; __eoi=ID=32cb7227ae4b3b68:T=1721913519:RT=1721913519:S=AA-Afjb7JbXLXpChPgWfUKZXbNdF

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c-2292-4cc4-8c71-78b44a037995/items?path=/README.md HTTP/1.1Host: dev.azure.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools.github.io/raw/master/docs/README.md HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /README.md HTTP/1.1Host: war3tools.github.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /project/war3tools/README.md?viasf=1 HTTP/1.1Host: master.dl.sourceforge.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools.github.io/master/docs/README.md HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /README.md HTTP/1.1Host: war3tools.suyx.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Accept-Encoding: gzip, deflateHost: war3tools.suyx.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=?download=SuWar3Tools.zip&randomtime=638574961174603590 HTTP/1.1Host: nim-nosdn.netease.imCache-Control: no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1Host: codeberg.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1Host: gitea.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/banner.html HTTP/1.1Host: war3tools.gitlab.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /ad/header.html HTTP/1.1Host: war3tools.suyx.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521"If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ad/banner.html HTTP/1.1Host: war3tools.gitlab.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /x/web-interface/zone HTTP/1.1Host: api.bilibili.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: war3tools.suyx.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://war3tools.suyx.net/ad/header.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: __gads=ID=3db76bb96bc61d49:T=1721913518:RT=1721913518:S=ALNI_MZbG8Djp3HAW8YyEyDeBQyV0rWmGw; __gpi=UID=00000eb054b56a23:T=1721913518:RT=1721913518:S=ALNI_MZJu1M0eTihEZq4YzRBr59EBWirJA; __eoi=ID=32cb7227ae4b3b68:T=1721913519:RT=1721913519:S=AA-Afjb7JbXLXpChPgWfUKZXbNdF

Source: global traffic	DNS traffic detected: DNS query: dev.azure.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: war3tools.github.io
Source: global traffic	DNS traffic detected: DNS query: master.dl.sourceforge.net
Source: global traffic	DNS traffic detected: DNS query: war3tools.suyx.net
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: nim-nosdn.netease.im
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: gitea.com
Source: global traffic	DNS traffic detected: DNS query: codeberg.org
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: war3tools.gitlab.io
Source: global traffic	DNS traffic detected: DNS query: api.bilibili.com
Source: global traffic	DNS traffic detected: DNS query: visitor-badge.laobi.icu
Source: global traffic	DNS traffic detected: DNS query: hits.dwyl.com

Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2651989893.0000000013977000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651574314.0000000013973000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651194631.0000000013970000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651704249.0000000013975000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651440514.0000000013972000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651835940.0000000013976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://.cdn.ampproject.netorg
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.0000000010713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://.cdn.ampproject.netorgA
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://108955.kefu.easemob.com/v1/Tenant/108955/MediaFiles/6e07bc39-f04f-4785-8717-d6130c588db3U3VXY
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: csc.exe, 0000001C.00000002.3298788163.0000000004AF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.co
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.debug.jsT
Source: csc.exe, 00000016.00000003.3125138951.00000000052ED000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125791799.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125381458.00000000052F1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3130968893.00000000052F5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3135656929.00000000052F6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.debug.jsT
Source: csc.exe, 00000016.00000002.3134952936.00000000052C8000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3267235462.0000000005108000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3297447721.0000000004AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.jsT
Source: csc.exe, 00000016.00000002.3134952936.00000000052C8000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3267235462.0000000005108000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3297447721.0000000004AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.debug.jsT
Source: csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.jsT
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2762718857.0000000006310000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2815350308.00000000062F0000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2872643403.00000000062A0000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://boxedapp.com/boxedappsdk/order.html
Source: LisectAVT_2403002B_286.exe	String found in binary or memory: http://boxedapp.com/boxedappsdk/order.htmlS:(ML;;NW;;;LW)U
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2808171126.0000000000AAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://boxedapp.com/boxedappsdk/order.html_
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2866433365.000000000094D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://boxedapp.com/boxedappsdk/order.htmlf
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2756783639.000000000096D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://boxedapp.com/boxedappsdk/order.htmlr
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://e.length
Source: f[1].txt.0.dr	String found in binary or memory: http://google.com
Source: f[1].txt.0.dr	String found in binary or memory: http://googleads.g.doubleclick.net
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://googleads.g.doubleclick.netLf.http://googleads.g.doubleclick.net
Source: csc.exe, 00000019.00000003.3251655485.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251370768.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3252719149.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3244944307.000000000512C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251655485.0000000005178000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3262862553.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, zkeqnbkw.0.cs.13.dr	String found in binary or memory: http://ip-api.com/json
Source: f[1].txt.0.dr	String found in binary or memory: http://mathiasbynens.be/
Source: f[1].txt.0.dr	String found in binary or memory: http://pagead2.googlesyndication.com
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pagead2.googlesyndication.com_Lf.http://pagead2.googlesyndication.com
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2603215891.000000001387F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2608253242.0000000013880000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2607708668.000000001387F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://adsense.com.H
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adsense.com.b.google_ad_client
Source: csc.exe, 00000019.00000003.3251655485.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251370768.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3252719149.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3244944307.000000000512C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251655485.0000000005178000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3262862553.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, zkeqnbkw.0.cs.13.dr	String found in binary or memory: https://api.bilibili.com/x/web-interface/zone
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://cdn.ampproject.org/amp4ads-host-v0.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://cdn.ampproject.org/rtv/
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2646768862.000000000F535000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646639347.000000000F532000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655068073.000000000F53D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646717732.000000000F534000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646680239.000000000F533000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646601399.000000000F531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org/rtv/google_bottom_anchor_debuggoogle_ad_frequency_hintallow-popups-to-esc
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codeberg.org/war3tools/war3tools/raw/branch/master/README.md
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txt
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txtp
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F87000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633370663.0000000013EF6000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633547622.0000000013EF8000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://cse.google.com/cse.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2646768862.000000000F535000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646639347.000000000F532000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655068073.000000000F53D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646717732.000000000F534000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646680239.000000000F533000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646601399.000000000F531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cse.google.com/cse.jsgoogle_wrap_fullscreen_adGoogle
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.azure.com
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.azure.com/war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.internxt.com/sh/folder/79ed1b38-26b8-4cbc-818e-5687b072eb1f/c0c84fdce9486632690de15d1e
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e.lengthe.lengthe.lengthe.lengthe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX)
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eapi.pcloud.com/getapiserver
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eapi.pcloud.com/getapiserverapihttps:///getpublinkdownload?fileid=fileid&hashCache=hash&code
Source: f[1].txt.0.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Google
Source: f[1].txt.0.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: f[1].txt.0.dr	String found in binary or memory: https://fundingchoicesmessages.google.com/i/%
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitea.com/war3tools/war3tools/raw/branch/master/README.mdlBcq
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitea.com/war3tools/war3tools/raw/branch/master/update.txt
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitea.com/war3tools/war3tools/raw/branch/master/update.txtp
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002F3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/war3tools/war3tools.github.io/raw/master/docs/README.mdp
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io/-/blob/main/Others/AdvancedCodeDemo/README.md)
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io/-/blob/main/Others/ExtDll/README.md)
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io/-/blob/main/Others/SuWar3ToolsExtDemo/README.md)
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3ToolsAd.png
Source: f[1].txt.0.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2656788771.000000000F2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7779916227810877&output=html&adk=181227
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.000000001071F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633008327.0000000013F25000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2609240005.0000000013EB1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587061684.000000000A1FF000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646639347.000000000F532000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655068073.000000000F53D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646717732.000000000F534000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646680239.000000000F533000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646601399.000000000F531000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/html/r20240723/r20110914/zrt_lookup.html
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.netLf.https://googleads.g.doubleclick.net
Source: csc.exe, 00000019.00000003.3251655485.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3252719149.0000000005189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/json?token=166
Source: csc.exe, 00000019.00000003.3251370768.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3244944307.000000000512C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251655485.0000000005178000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3262862553.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, zkeqnbkw.0.cs.13.dr	String found in binary or memory: https://ipinfo.io/json?token=1660032ac35c98
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002F45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://master.dl.sourceforge.net
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://master.dl.sourceforge.net/project/war3tools/README.md?viasf=1
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://master.dl.sourceforge.net/project/war3tools/README.md?viasf=1lBcq
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://master.dl.sourceforge.net/project/war3tools/SuWar3Tools.exe?viasf=1
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://master.dl.sourceforge.net/project/war3tools/SuWar3Tools.zip?viasf=1
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nim-nosdn.netease.im
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxMjgxMTU3ODE4MV8xNDIwNjM4Zi0xZj
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMwNDkxNF9jNWM0YWYyYy05ZD
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02Zj
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=plmetrics
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2633008327.0000000013F25000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/html/
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2633249058.0000000013F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js(
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.3215467232.000000002732C000.00000004.00000800.00020000.00000000.sdmp, header[1].htm.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7779916227810877
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.0000000010713000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671352272.0000000013F14000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673846552.0000000013F7F000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633370663.0000000013EEC000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587265354.000000000A1EA000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587113384.000000000A1D7000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655216904.000000001385F000.00000004.00000800.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/err_rep.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2647506001.000000000FB1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/err_rep.jshttps://pagead2.googlesyndication.com/page
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671352272.0000000013F14000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2609340452.000000000A256000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2652989903.0000000013930000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2609665332.000000000A25A000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587113384.000000000A1D7000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587346087.000000000A1D8000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/logging_library.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2647506001.000000000FB1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/js/logging_library.jshttps://pagead2.googlesyndication.
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2607433797.0000000013A45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/https://pagead2.googlesyndication.co
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2646404396.000000000F57B000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655777991.000000000F57B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202407180101/autogames.js.
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2608373278.0000000013937000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202407180101/show_ads_impl.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202407180101/show_ads_impl.js?bust=
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.3215467232.000000002732C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202407220101/show_ads_impl_fy2021.j
Source: f[1].txt.0.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/ping
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2671352272.0000000013F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/pingt.globalThist.globalThis.fetch
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/pingu.globalThis
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pagead2.googlesyndication.comLf.https://pagead2.googlesyndication.com.
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/war3tools/war3tools.github.io/master/docs/README.md
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s3.goftino.com/dl/2024/64f9848fe0efc04f9cbe549e/lelplhny2wfdap7dpqje9yw9/suwar3toolsext.zip
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2633008327.0000000013F25000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/projects/war3tools/files/
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourceforge.net/projects/war3tools/files/)
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://tpc.googlesyndication.com/sodar/
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002F45000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.github.io
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.github.io/README.mdp
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.github.io/update.txtp
Source: header[1].htm.0.dr	String found in binary or memory: https://war3tools.gitlab.io
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.gitlab.io/README.md
Source: csc.exe, 00000016.00000003.3114848635.00000000052EB000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3122034194.0000000005346000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3129215839.0000000005981000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3131206056.00000000052E1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3135207185.00000000052E3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3130750345.00000000052DE000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3122760329.0000000005335000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3289487980.00000000049F1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3279832793.0000000004B46000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3279832793.0000000004B37000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3280833487.0000000004B4A000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3274310204.0000000004ADB000.00000004.00000020.00020000.00000000.sdmp, srv33q4h.0.cs.13.dr, 1kjwnqt4.0.cs.13.dr	String found in binary or memory: https://war3tools.gitlab.io/ad/banner.html
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.gitlab.io/update.txt
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.gitlab.io/update.txtp
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/README.md
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000031EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2656788771.000000000F2C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html$
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html&pra=5&wgl=1&easpi=0&aihb=0&asro=0&ailel=27~1~2~4~6~7~8~9~1
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html...
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html...TU
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2646949285.000000000F855000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2656752164.000000000F856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html4
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000003021000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.htmlT
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.html_286.dlll
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000003021000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.htmld
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2654812759.00000000139C1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2670948414.00000000139C2000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2654701823.00000000139C0000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.htmlhttps://pagead2.googlesyndication.com/pagead/js/adsbygoogle
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.0000000010713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.htmlhttps://war3tools.suyx.net/ad/header.htmlh
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000003021000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://war3tools.suyx.net/ad/header.htmlmhq
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2633122649.000000000A1FE000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671937255.000000000A258000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671670121.000000000A205000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/adsense
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F87000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633370663.0000000013EF6000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633547622.0000000013EF8000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://www.google.com/adsense/search/async-ads.js
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/adsense3
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2601993674.000000000A22A000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2609340452.000000000A256000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2602037939.000000000A22F000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2602104653.000000000A23A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/adsenseff
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2633122649.000000000A1FE000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671937255.000000000A258000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671670121.000000000A205000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/adsensentact
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/aframe
Source: f[1].txt.0.dr	String found in binary or memory: https://www.google.com/s2/favicons?sz=64&domain_url=
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com/adsense/autoads/icons/arrow_left_24px_grey_800.svg
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com/adsense/autoads/icons/close_24px_grey_700.svg
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com/adsense/autoads/icons/gpp_good_24px_blue_600.svg
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com/adsense/autoads/icons/gpp_good_24px_grey_800.svg
Source: f[1].txt.0.dr	String found in binary or memory: https://www.gstatic.com/prose/protected/%
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 185.199.108.153:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.105.38.12:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.20:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 163.181.92.223:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.197.91.145:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.166.250.135:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.185.44.232:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.153.35.66:443 -> 192.168.2.5:49811 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.LisectAVT_2403002B_286.exe.3ba9550.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.8540000.27.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.9990000.29.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.815ef4c.26.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 13.3.LisectAVT_2403002B_286.exe.7eb016c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.3.LisectAVT_2403002B_286.exe.7eb4170.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 13.3.LisectAVT_2403002B_286.exe.7eb6170.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.95959c8.28.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ebb170.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.8110000.23.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7eb516c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.9990000.29.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8164f50.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.3ba9550.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7eba16c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.815ef4c.16.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7ec0170.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.3.LisectAVT_2403002B_286.exe.7eb9974.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7ec5974.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.3.LisectAVT_2403002B_286.exe.7eae16c.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.95959c8.28.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.816a754.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.815ef4c.15.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 0.3.LisectAVT_2403002B_286.exe.7f5fe60.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.8164f50.25.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ec0974.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 13.3.LisectAVT_2403002B_286.exe.7ebb974.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 10.2.LisectAVT_2403002B_286.exe.816a754.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8164f50.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 0000000B.00000002.2887278083.00000000099B0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables packed with DNGuard Author: ditekSHen
Source: 0000000A.00000002.2831351105.0000000009990000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables packed with DNGuard Author: ditekSHen

PE file contains section with special chars

Source: LisectAVT_2403002B_286.exe

Static PE information: section name: .m!S

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C4C0 NtQueryVolumeInformationFile,	0_2_04E5C4C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E765A0 NtClose,	0_2_04E765A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C5B0 NtSetSecurityObject,	0_2_04E5C5B0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C500 NtFsControlFile,	0_2_04E5C500
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E7E640 NtDeviceIoControlFile,	0_2_04E7E640
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C0C0 NtWriteFile,	0_2_04E5C0C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C070 NtReadFile,	0_2_04E5C070
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C1C0 NtCreateSection,	0_2_04E5C1C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C190 NtOpenSection,	0_2_04E5C190
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C110 NtSetInformationFile,	0_2_04E5C110
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C290 NtUnmapViewOfSection,	0_2_04E5C290
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C200 NtMapViewOfSection,	0_2_04E5C200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C3A0 NtQueryAttributesFile,	0_2_04E5C3A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5C350 NtQueryDirectoryFile,	0_2_04E5C350
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E90D61 NtOpenFile,	0_2_04E90D61
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E7CF50 NtQueryInformationProcess,	0_2_04E7CF50
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E0F5C0 NtOpenFile,	0_2_04E0F5C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E0F150 NtOpenFile,NtOpenFile,NtQueryDirectoryFile,	0_2_04E0F150
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E0B200 NtQueryInformationProcess,WNetGetConnectionW,NtOpenFile,NtOpenFile,NtQueryDirectoryFile,	0_2_04E0B200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5BCF0 NtOpenKey,	0_2_04E5BCF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5BFF0 NtCreateFile,	0_2_04E5BFF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5BFB0 NtOpenFile,	0_2_04E5BFB0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E8DAB0 NtQueryInformationProcess,	0_2_04E8DAB0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5BA80 NtDuplicateObject,	0_2_04E5BA80
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E5BA50 NtClose,	0_2_04E5BA50
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E77B00 NtSetSecurityObject,NtSetSecurityObject,	0_2_04E77B00
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C4C0 NtQueryVolumeInformationFile,	9_2_04E4C4C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E665A0 NtClose,CloseHandle,	9_2_04E665A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C5B0 NtSetSecurityObject,	9_2_04E4C5B0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C500 NtFsControlFile,	9_2_04E4C500
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E6E640 NtDeviceIoControlFile,NtOpenFile,CloseHandle,	9_2_04E6E640
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C0C0 NtWriteFile,	9_2_04E4C0C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C070 NtReadFile,	9_2_04E4C070
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C1C0 NtCreateSection,	9_2_04E4C1C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C190 NtOpenSection,	9_2_04E4C190
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C110 NtSetInformationFile,	9_2_04E4C110
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C290 NtUnmapViewOfSection,	9_2_04E4C290
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C200 NtMapViewOfSection,	9_2_04E4C200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C3A0 NtQueryAttributesFile,	9_2_04E4C3A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4C350 NtQueryDirectoryFile,	9_2_04E4C350
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E80D60 TlsGetValue,NtOpenFile,	9_2_04E80D60
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E6CF50 RtlInitUnicodeString,NtQueryInformationProcess,	9_2_04E6CF50
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E94BD0 GetCurrentProcessId,wsprintfW,ConvertStringSecurityDescriptorToSecurityDescriptorW,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateMutexW,LocalFree,GetModuleHandleW,GetProcAddress,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,NtSetSecurityObject,NtSetSecurityObject,LocalFree,	9_2_04E94BD0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E90B90 GetTickCount,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,IsWow64Process,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAddVectoredExceptionHandler,VirtualAlloc,VirtualAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,VirtualAlloc,GetSystemInfo,GetVersionExW,RtlUpcaseUnicodeChar,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,ConvertSidToStringSidW,LocalFree,FindCloseChangeNotification,RtlInitUnicodeString,GetProcessHeap,HeapAlloc,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FindResourceW,LoadResource,LockResource,SizeofResource,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,GetComputerNameW,GetComputerNameW,GetLastError,GetProcessHeap,HeapReAlloc,GetComputerNameW,GetCurrentProcessId,RegOpenKeyW,RegOpenKeyW,RegCloseKey,NtQueryKey,NtQueryKey,RegCloseKey,RegOpenKeyW,NtQueryKey,RegCloseKey,NtCreateKey,NtOpenKey,NtQueryKey,CloseHandle,NtQueryAttributesFile,FileTimeToSystemTime,GetModuleHandleW,GetProcAddress,NtQueryInformationFile,SetLastError,CreateActCtxW,GetLastError,ConvertStringSecurityDescriptorToSecurityDescriptorW,	9_2_04E90B90
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DFF5C0 NtOpenFile,	9_2_04DFF5C0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DFF150 NtOpenFile,NtOpenFile,NtQueryDirectoryFile,	9_2_04DFF150
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DFB200 _chkstk,lstrcmpiW,TlsGetValue,TlsSetValue,GetCurrentProcess,NtQueryInformationProcess,WNetGetConnectionW,WNetGetConnectionW,RtlCompareUnicodeString,TlsGetValue,TlsSetValue,TlsGetValue,TlsSetValue,GetCurrentThreadId,InterlockedCompareExchange,RtlCompareUnicodeString,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,NtOpenFile,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,NtOpenFile,NtQueryDirectoryFile,	9_2_04DFB200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4BCF0 NtOpenKey,	9_2_04E4BCF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4BFF0 NtCreateFile,	9_2_04E4BFF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4BFB0 NtOpenFile,	9_2_04E4BFB0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E85F30 TlsGetValue,NtClose,	9_2_04E85F30
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DD9810 ResetEvent,RtlCompareUnicodeString,RtlCompareUnicodeString,SetEvent,GetCurrentThread,NtQueueApcThread,	9_2_04DD9810
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E7DAB0 GetCurrentProcess,NtQueryInformationProcess,RtlCompareUnicodeString,	9_2_04E7DAB0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4BA80 NtDuplicateObject,	9_2_04E4BA80
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E4BA50 NtClose,	9_2_04E4BA50
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E67B00 TlsGetValue,TlsGetValue,TlsSetValue,TlsSetValue,NtSetSecurityObject,TlsGetValue,TlsSetValue,NtSetSecurityObject,TlsGetValue,TlsSetValue,	9_2_04E67B00
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E764A0 ReadProcessMemory,CreateFileW,ReadFile,ReadFile,SetFilePointer,ReadFile,CloseHandle,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,VirtualAllocEx,MapViewOfFile,UnmapViewOfFile,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetLastError,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetLastError,GetCurrentProcess,DuplicateHandle,GetLastError,lstrlenW,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,CreateEventW,GetCurrentProcess,DuplicateHandle,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForMultipleObjects,ResumeThread,	9_2_04E764A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E666D0 NtMapViewOfSection,	9_2_04E666D0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E66760 NtUnmapViewOfSection,	9_2_04E66760
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E6C0E0 NtQueryInformationProcess,ReadProcessMemory,	9_2_04E6C0E0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E660F0 VirtualProtectEx,VirtualProtectEx,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,	9_2_04E660F0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DF8000 GetCurrentThreadId,InterlockedCompareExchange,NtQueueApcThread,SetEvent,SetEvent,SetEvent,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,	9_2_04DF8000
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E66190 NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,	9_2_04E66190
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E823A0 TlsGetValue,GetCurrentThread,NtQueueApcThread,	9_2_04E823A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DCADB0 ResetEvent,ResetEvent,ResetEvent,IsBadReadPtr,SetEvent,SetEvent,SetEvent,GetCurrentThread,NtQueueApcThread,	9_2_04DCADB0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E7EEF0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetCurrentDirectoryW,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,LoadLibraryExW,CreateActCtxW,ActivateActCtx,DeactivateActCtx,FreeLibrary,VirtualProtect,GetModuleHandleW,VirtualProtect,VirtualProtect,GetModuleHandleW,LoadLibraryW,GetProcAddress,ExitProcess,ExitProcess,ExitProcess,CreateFileW,GetFileSize,ReadFile,CloseHandle,GetCurrentProcess,NtQueryInformationProcess,VirtualQuery,VirtualProtect,RtlInitUnicodeString,RtlInitUnicodeString,AttachConsole,AllocConsole,SetConsoleTitleW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetEnvironmentVariableW,SetEnvironmentVariableW,LoadLibraryExW,CreateActCtxW,ActivateActCtx,LoadLibraryW,LoadLibraryA,GetProcAddress,LoadLibraryA,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetCommandLineW,LocalFree,LoadLibraryW,GetProcAddress,ExitProcess,ExitProcess,WaitForSingleObject,GetLastError,GetLastError,DeleteFileW,GetLastError,	9_2_04E7EEF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DCA8F0 ResetEvent,ResetEvent,ResetEvent,IsBadWritePtr,SetEvent,SetEvent,SetEvent,GetCurrentThread,NtQueueApcThread,	9_2_04DCA8F0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DD0AD0 GetCurrentThreadId,InterlockedCompareExchange,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,NtSetIoCompletion,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,	9_2_04DD0AD0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E67660 GetModuleHandleW,GetModuleHandleA,GetCurrentProcess,NtQueryInformationProcess,VirtualProtect,GetProcAddress,VirtualProtect,	9_2_04E67660
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E99070 InterlockedCompareExchange,InterlockedCompareExchange,GetCurrentProcess,NtQueryInformationProcess,	9_2_04E99070
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DF7170 NtSetIoCompletion,	9_2_04DF7170
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DFF3B0 NtOpenSymbolicLinkObject,NtQuerySymbolicLinkObject,NtQuerySymbolicLinkObject,	9_2_04DFF3B0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E09DF0 ResetEvent,SetEvent,GetCurrentThread,NtQueueApcThread,	9_2_04E09DF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E73E00 GetCurrentProcess,NtQueryInformationProcess,	9_2_04E73E00
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E97970 GetCurrentProcess,GetCurrentProcessId,GetCurrentProcessId,GetCurrentProcessId,NtQueryInformationProcess,GetCurrentProcessId,	9_2_04E97970
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E97930 GetCurrentProcess,GetCurrentProcessId,NtQueryInformationProcess,	9_2_04E97930
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E6FB60 GetCurrentProcess,NtMapViewOfSection,RtlCreateActivationContext,	9_2_04E6FB60

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Code function: 0_2_04E7E640: NtDeviceIoControlFile,

0_2_04E7E640

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E8E190	0_2_04E8E190
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E0B200	0_2_04E0B200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_04E600A0	0_2_04E600A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E7E190	9_2_04E7E190
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E90B90	9_2_04E90B90
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DFB200	9_2_04DFB200
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E764A0	9_2_04E764A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E847B0	9_2_04E847B0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E500A0	9_2_04E500A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E7EEF0	9_2_04E7EEF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E48920	9_2_04E48920
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E7CAD0	9_2_04E7CAD0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E45550	9_2_04E45550
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E016A0	9_2_04E016A0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E891D0	9_2_04E891D0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E87CF0	9_2_04E87CF0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E9BC90	9_2_04E9BC90
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DD3DD0	9_2_04DD3DD0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04DCDAC0	9_2_04DCDAC0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099E0558	9_2_099E0558
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099E0040	9_2_099E0040
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099E1368	9_2_099E1368
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099E1760	9_2_099E1760
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02656010	9_2_02656010
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265C277	9_2_0265C277
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265C278	9_2_0265C278
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265F230	9_2_0265F230
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265600F	9_2_0265600F
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02657157	9_2_02657157
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02657158	9_2_02657158
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_026596C8	9_2_026596C8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265F460	9_2_0265F460
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265EA27	9_2_0265EA27
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265EA28	9_2_0265EA28
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265AB90	9_2_0265AB90
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265F83F	9_2_0265F83F
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265F888	9_2_0265F888
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265AE10	9_2_0265AE10
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0265ADB8	9_2_0265ADB8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_09A1ADA8	9_2_09A1ADA8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652CF7	9_2_02652CF7
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D67	9_2_02652D67
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D77	9_2_02652D77
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D47	9_2_02652D47
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D37	9_2_02652D37
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652DC8	9_2_02652DC8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D87	9_2_02652D87
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_02652D97	9_2_02652D97

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: String function: 04E30AB0 appears 50 times
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: String function: 04E69600 appears 90 times
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: String function: 04E50700 appears 67 times
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: String function: 04E940C0 appears 143 times
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: String function: 04E50510 appears 153 times

Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2469473146.000000000440E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000000.2167658246.00000000008A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename2600ea26aee.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000000.2167380964.000000000046B000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000000.2167380964.0000000000576000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2179041784.0000000000C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2469473146.00000000042B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000031D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InternalNameOriginalFilename1.24.4.6387Maps\dota.w3x"D:\War\war3.exe" -windowCheckFilter ExceptionStartExe[path][args][WorkingDirectory][Arguments]StartExe Exceptioncmd.exe/c {0}:{1} vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2698785893.000000000046D000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2707214759.0000000003E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2698167599.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2698167599.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNRuntime.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2469473146.0000000004735000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2707214759.0000000003F6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2178912424.000000000974A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000031EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 00000000.00000003.2169352243.0000000007F4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSupport64.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2830583255.0000000009540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2750513615.0000000009757000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2818060378.0000000007E40000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDNRuntime.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2807622156.0000000000907000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2813624681.0000000004E4A000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2750693430.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.000000000424D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2807046039.000000000046D000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2798814496.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000000.2735618078.000000000046B000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.00000000045DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename49732f42286.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2820026041.0000000008010000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSuLibrary.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2798814496.0000000003BEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000000.2735618078.0000000000576000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuWar3Tools.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.00000000040D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2813624681.0000000004D40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2822734108.0000000008112000.00000020.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSupport64.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2822734108.0000000008112000.00000020.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSuBrowser.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2822734108.0000000008112000.00000020.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSuLibrary.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2806663592.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2806663592.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNRuntime.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2819917748.0000000007FF0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSupport64.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2819917748.0000000007FF0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSuBrowser.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.0000000003BCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2738044377.0000000007E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSupport64.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2738044377.0000000007E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuBrowser.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000003.2738044377.0000000007E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuLibrary.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.0000000003D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InternalNameOriginalFilename1.24.4.6387Maps\dota.w3x"D:\War\war3.exe" -windowCheckFilter ExceptionStartExe[path][args][WorkingDirectory][Arguments]StartExe Exceptioncmd.exe/c {0}:{1} vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2831351105.0000000009990000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2827129816.0000000008546000.00000002.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDNRuntime.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename@\cq OriginalFilename vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2811809330.0000000003BA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000002.3423158024.000000000046D000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000000.2855480726.0000000000907000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename49732f42286.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2865243137.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000000.2855007043.000000000046B000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2856843634.0000000007E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSupport64.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2856843634.0000000007E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuBrowser.exe4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2856843634.0000000007E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSuLibrary.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2948225846.00000000041D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename49732f42286.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.3134279389.0000000027234000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename49732f42286.exe" vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000002.3417089647.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNGuard.Runtime.dll@ vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000002.3417089647.0000000000183000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDNRuntime.dll4 vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000000.2855007043.0000000000576000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2948225846.0000000003E43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe, 0000000D.00000003.2948225846.0000000003CEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe	Binary or memory string: OriginalFilenameBoxedAppSDK_AppDomainManager.dllP vs LisectAVT_2403002B_286.exe
Source: LisectAVT_2403002B_286.exe	Binary or memory string: OriginalFilenameBoxedAppSDK.dll: vs LisectAVT_2403002B_286.exe

Source: LisectAVT_2403002B_286.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 10.2.LisectAVT_2403002B_286.exe.3ba9550.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.8540000.27.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.9990000.29.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.815ef4c.26.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 13.3.LisectAVT_2403002B_286.exe.7eb016c.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.92d5600.18.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.3.LisectAVT_2403002B_286.exe.7eb4170.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 13.3.LisectAVT_2403002B_286.exe.7eb6170.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.95959c8.28.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ebb170.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.8110000.23.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7eb516c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.9990000.29.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8164f50.16.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.3ba9550.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7eba16c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.3dc9550.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.815ef4c.16.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7ec0170.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.3.LisectAVT_2403002B_286.exe.7eb9974.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.3.LisectAVT_2403002B_286_Update.exe.7ec5974.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.3.LisectAVT_2403002B_286.exe.7eae16c.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.95959c8.28.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.816a754.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.815ef4c.15.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 0.3.LisectAVT_2403002B_286.exe.7f5fe60.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8110000.13.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.8164f50.25.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ec0974.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8560000.17.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.99b0000.19.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.92d53f8.18.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 13.3.LisectAVT_2403002B_286.exe.7ebb974.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.3cf9550.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 10.2.LisectAVT_2403002B_286.exe.816a754.24.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 9.2.LisectAVT_2403002B_286_Update.exe.99c0000.19.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 11.2.LisectAVT_2403002B_286_Update.exe.8164f50.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 0000000B.00000002.2887278083.00000000099B0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard
Source: 0000000A.00000002.2831351105.0000000009990000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_EXE_Packed_DNGuard author = ditekSHen, description = Detects executables packed with DNGuard

Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ebb170.1.raw.unpack, -.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 9.3.LisectAVT_2403002B_286_Update.exe.7ebb170.1.raw.unpack, -.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8164f50.16.raw.unpack, -.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 9.2.LisectAVT_2403002B_286_Update.exe.8164f50.16.raw.unpack, -.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: LisectAVT_2403002B_286.exe	Binary string: \??\UVMLite\??\Nsi\??\con\??\MountPointManager\??\CbFs3NrIoctl\??\PrlMiniRdrDN\Device\NETBT_TCPIP_\Device\LanmanDatagramReceiver\Device\RdpDr\Device\RasAcd\Device\WS2IFSL\Device\DeviceApi\\Device\KsecDD\Device\CNG\DosDevices\pipe\\Device\DfsClient\Device\Afd\Device\Csc\Device\Mailslot\\Device\NamedPipe\\??\pipe\
Source: LisectAVT_2403002B_286.exe	Binary string: \Device\\??\UNC\??\Z:FullWriteCopyMergedNone

Source: classification engine

Classification label: mal69.expl.evad.winEXE@24/35@25/11

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04E2E780 CoCreateInstance,VariantClear,VariantClear,SysAllocString,SysAllocString,VariantClear,SysAllocString,VariantClear,VariantClear,SysAllocString,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,wsprintfW,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,

9_2_04E2E780

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04E90B90 GetTickCount,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,IsWow64Process,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAddVectoredExceptionHandler,VirtualAlloc,VirtualAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,VirtualAlloc,GetSystemInfo,GetVersionExW,RtlUpcaseUnicodeChar,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,ConvertSidToStringSidW,LocalFree,FindCloseChangeNotification,RtlInitUnicodeString,GetProcessHeap,HeapAlloc,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FindResourceW,LoadResource,LockResource,SizeofResource,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,GetComputerNameW,GetComputerNameW,GetLastError,GetProcessHeap,HeapReAlloc,GetComputerNameW,GetCurrentProcessId,RegOpenKeyW,RegOpenKeyW,RegCloseKey,NtQueryKey,NtQueryKey,RegCloseKey,RegOpenKeyW,NtQueryKey,RegCloseKey,NtCreateKey,NtOpenKey,NtQueryKey,CloseHandle,NtQueryAttributesFile,FileTimeToSystemTime,GetModuleHandleW,GetProcAddress,NtQueryInformationFile,SetLastError,CreateActCtxW,GetLastError,ConvertStringSecurityDescriptorToSecurityDescriptorW,

9_2_04E90B90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File created: C:\Users\user\Desktop\SuWar3Tools.cfg

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\84C97AE0
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_00000e68_0000112c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_00000e68_0000112c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_00001948_00001950
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_0000159c_000018cc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_00001410_00000c7c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_00001294_0000146c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_00001410_00000c7c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5524:120:WilError_03
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_00001294_0000146c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_00001948_00001950
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_00001294_0000146c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_0000159c_000018cc_0000159c
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00001294_0000146c_00001294
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_00001948_00001950
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_process_list_mutex_0000159c_000018cc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00001410_00000c7c_00001410
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_00001410_00000c7c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00000e68_0000112c_00000e68
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\bx_process_mutex_00001948_00001950_00001948
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_global_shared_mem_0000159c_000018cc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Mutant created: \Sessions\1\BaseNamedObjects\boxedapp_shared_env_mutex_00000e68_0000112c

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File created: C:\Users\user\AppData\Local\Temp\SuWar3Tools

Source: LisectAVT_2403002B_286.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.72%

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3017.tmp" "c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6262.tmp" "c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D8E.tmp" "c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3017.tmp" "c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6262.tmp" "c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D8E.tmp" "c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP"

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File opened: C:\Users\user\Desktop\SuWar3Tools.cfg

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: OK
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Automated click: Run

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: LisectAVT_2403002B_286.exe

Static file information: File size 4861966 > 1048576

Source: LisectAVT_2403002B_286.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x135000
Source: LisectAVT_2403002B_286.exe	Static PE information: Raw size of .m!S is bigger than: 0x100000 < 0x1ba000
Source: LisectAVT_2403002B_286.exe	Static PE information: Raw size of .pdata is bigger than: 0x100000 < 0x143000

Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\obj\win32\release_full\boxedappsdkthunk\BoxedAppSDKThunk.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Microsoft.Web.WebView2.Core.dll.13.dr
Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\bin\release_full\bxsdk32.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: V:\builds\BoxedApp\files\8CC2254F\src\BoxedApp\bxsdk\obj\x86\Release_Full\BoxedAppSDK_AppDomainManager.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.WinForms.pdb source: Microsoft.Web.WebView2.WinForms.dll.13.dr
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb< source: Microsoft.Web.WebView2.Core.dll.13.dr
Source:	Binary string: v:\builds\boxedapp\files\8cc2254f\src\boxedapp\bxsdk\obj\win32\release_full\tlssupport\TLSSupport.pdb source: LisectAVT_2403002B_286.exe
Source:	Binary string: D:\Code\Others\SuWar3Tools\SuLibrary\obj\Release\SuLibrary.pdb source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2773345003.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000003.2697372563.0000000007E68000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2771084886.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2820026041.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2822734108.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000003.2738044377.0000000007E61000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882566524.0000000008112000.00000020.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000003.2807536228.0000000007E6D000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2881628340.0000000008010000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000D.00000003.2856843634.0000000007E63000.00000004.00000020.00020000.00000000.sdmp, SuLibrary.dll.13.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, MyCompiler.cs	.Net Code: GeteObjectWithFullCod
Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, RemoteLoader.cs	.Net Code: LoadByteAssembly System.Reflection.Assembly.Load(byte[])
Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, RemoteLoader.cs	.Net Code: CompiledExec
Source: 9.2.LisectAVT_2403002B_286_Update.exe.816a754.14.raw.unpack, RemoteLoader.cs	.Net Code: CompiledExecAsync

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E90B90

Source: LisectAVT_2403002B_286.exe	Static PE information: real checksum: 0x4a63cb should be: 0x4a61af
Source: LisectAVT_2403002B_286_Update.exe.0.dr	Static PE information: real checksum: 0x512047 should be: 0x511f3a
Source: LisectAVT_2403002B_286.exe.9.dr	Static PE information: real checksum: 0x512047 should be: 0x511f3a

Source: LisectAVT_2403002B_286.exe	Static PE information: section name: .m!S
Source: LisectAVT_2403002B_286_Update.exe.0.dr	Static PE information: section name: .GS.
Source: LisectAVT_2403002B_286.exe.9.dr	Static PE information: section name: .GS.

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_13B1F683 push es; retf	0_3_13B1F687
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_3_0DB09C5C push esi; ret	0_3_0DB09C5E
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Code function: 0_2_0043DF3D push ecx; ret	0_2_0043DF50
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931B3BD push esp; iretd	9_3_0931B3BE
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931D9FE push cs; ret	9_3_0931DA15
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931A7E3 push eax; retf	9_3_0931A7F6
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931E46D push es; retf	9_3_0931E470
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931B4A6 push esi; iretd	9_3_0931B4A7
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_3_0931E2F4 push edi; iretd	9_3_0931E2F5
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_0043DF5D push ecx; ret	9_2_0043DF70
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04EBBA64 pushfd ; iretd	9_2_04EBBA74
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099D8390 push cs; iretd	9_2_099D8398
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099D53A6 push cs; iretd	9_2_099D53B8
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_099D836B push cs; iretd	9_2_099D8374

Source: LisectAVT_2403002B_286.exe	Static PE information: section name: .m!S entropy: 7.6941834302880014
Source: LisectAVT_2403002B_286_Update.exe.0.dr	Static PE information: section name: .GS. entropy: 7.697127639688447
Source: LisectAVT_2403002B_286.exe.9.dr	Static PE information: section name: .GS. entropy: 7.697127639688447

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe.zip (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	File created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\AppData\Local\Temp\SuWar3Tools\SuLibrary\SuLibrary.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	File created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

File deleted: c:\users\user\desktop\lisectavt_2403002b_286.exe

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E90B90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	RDTSC instruction interceptor: First address: 641523 second address: 64157E instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esi+00000148h], ebx 0x00000008 bswap cx 0x0000000b cdq 0x0000000c mov dword ptr [esi+00000090h], ebx 0x00000012 mov dword ptr [esi+00000094h], ebx 0x00000018 lahf 0x00000019 mov dword ptr [esi+00000354h], ebx 0x0000001f cmovb ecx, ecx 0x00000022 movzx edx, cx 0x00000025 mov byte ptr [esp+18h], FFFFFF8Bh 0x0000002a movsx eax, ax 0x0000002d not dx 0x00000030 mov al, 19h 0x00000032 mov byte ptr [esp+19h], FFFFFFF8h 0x00000037 cdq 0x00000038 mov byte ptr [esp+1Ah], 0000003Bh 0x0000003d setnl dl 0x00000040 lahf 0x00000041 cbw 0x00000043 mov byte ptr [esp+1Bh], FFFFFFFBh 0x00000048 movsx eax, dx 0x0000004b movzx ecx, sp 0x0000004e bswap cx 0x00000051 mov eax, dword ptr [esp+18h] 0x00000055 mov dword ptr [esi+000001FCh], eax 0x0000005b rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	RDTSC instruction interceptor: First address: 4038B7 second address: 4038F4 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, sp 0x00000005 mov byte ptr [esp+1Dh], FFFFFF84h 0x0000000a mov byte ptr [esp+1Eh], FFFFFFBFh 0x0000000f cmovb edx, eax 0x00000012 mov byte ptr [esp+1Fh], 00000019h 0x00000017 mov ecx, dword ptr [esp+1Ch] 0x0000001b mov al, 82h 0x0000001d cdq 0x0000001e movzx edx, si 0x00000021 mov dword ptr [esi+00000200h], ecx 0x00000027 cwd 0x00000029 setns al 0x0000002c push 00000100h 0x00000031 cmovle eax, ebx 0x00000034 mov byte ptr [esp+24h], 00000028h 0x00000039 mov byte ptr [esp+25h], bl 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	RDTSC instruction interceptor: First address: 661FC0 second address: 661FC9 instructions: 0x00000000 rdtsc 0x00000002 not ax 0x00000005 mov ecx, dword ptr [esp+14h] 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	RDTSC instruction interceptor: First address: 4038B7 second address: 4038F4 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, sp 0x00000005 mov byte ptr [esp+1Dh], FFFFFF84h 0x0000000a mov byte ptr [esp+1Eh], FFFFFFBFh 0x0000000f cmovb edx, eax 0x00000012 mov byte ptr [esp+1Fh], 00000019h 0x00000017 mov ecx, dword ptr [esp+1Ch] 0x0000001b mov al, 82h 0x0000001d cdq 0x0000001e movzx edx, si 0x00000021 mov dword ptr [esi+00000200h], ecx 0x00000027 cwd 0x00000029 setns al 0x0000002c push 00000100h 0x00000031 cmovle eax, ebx 0x00000034 mov byte ptr [esp+24h], 00000028h 0x00000039 mov byte ptr [esp+25h], bl 0x0000003d rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	RDTSC instruction interceptor: First address: 661FC0 second address: 661FC9 instructions: 0x00000000 rdtsc 0x00000002 not ax 0x00000005 mov ecx, dword ptr [esp+14h] 0x00000009 rdtsc

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 10550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 10960000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 10AE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 10B00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 10D40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 13990000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 13A50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 13A70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 13AB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 13AD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2630000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 2A90000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2630000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Memory allocated: 2670000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 2452	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 5612	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 1043
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 1713
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 5659
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Window / User API: threadDelayed 4050

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\SuWar3Tools\SuLibrary\SuLibrary.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.dll	Jump to dropped file

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_9-129173

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

API coverage: 7.8 %

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 1784	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 5248	Thread sleep time: -36900s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 4484	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 6364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe TID: 3792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 2520	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 6208	Thread sleep count: 1043 > 30
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 6208	Thread sleep count: 1713 > 30
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 5884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe TID: 6428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe TID: 2968	Thread sleep time: -34126476536362649s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E9ABB0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Code function: 0_2_04E75880 GetSystemInfo,

0_2_04E75880

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Thread delayed: delay time: 922337203685477

Source: LisectAVT_2403002B_286.exe	Binary or memory string: VMware
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2756783639.00000000009CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}l
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882953244.00000000083FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2866433365.000000000099F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882953244.00000000083FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \Device\MountPointManager00025VMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2866433365.000000000099F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}mb
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882953244.00000000083FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}fb8b}`
Source: LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2882953244.00000000083FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \Device\00000025en_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}fb8b}^
Source: LisectAVT_2403002B_286.exe, 0000000A.00000002.2830816575.00000000097A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2756783639.00000000009CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\`
Source: LisectAVT_2403002B_286.exe	Binary or memory string: ErrorUnknown ,Version=Culture=PublicKeyToken=ProcessorArchitecture=neutral0 ., - Virtual Machine Network Services DriverVMwareBluetoothWiFiWLan802.11%02X-%02X-%02X-%02X-%02X-%02XCreate Com failed.root\cimv2Can't Connect to WMI Service: HR: 0x%X, LastError: 0x%XWMI ACCESS_DENIEDset proxy failed\|:InterfaceTypeUSBIndexManufacturerProductSerialNumberVersionWin32_BaseBoardNameSMBIOSBIOSVersionWin32_BIOSProcessorIdWin32_ProcessorModelWin32_DiskDriveWin32_PhysicalMedia%.4X

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Code function: 0_2_04E8DB90 LdrLoadDll,

0_2_04E8DB90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04DDD230 GetCurrentThreadId,InterlockedCompareExchange,InterlockedExchange,InterlockedDecrement,ReleaseSemaphore,IsDebuggerPresent,RaiseException,

9_2_04DDD230

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E90B90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E90B90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E90B90 GetTickCount,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,TlsAlloc,GetModuleHandleW,GetProcAddress,GetProcAddress,GetCurrentProcess,IsWow64Process,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAddVectoredExceptionHandler,VirtualAlloc,VirtualAlloc,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,VirtualAlloc,GetSystemInfo,GetVersionExW,RtlUpcaseUnicodeChar,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,ConvertSidToStringSidW,LocalFree,FindCloseChangeNotification,RtlInitUnicodeString,GetProcessHeap,HeapAlloc,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FindResourceW,LoadResource,LockResource,SizeofResource,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,GetComputerNameW,GetComputerNameW,GetLastError,GetProcessHeap,HeapReAlloc,GetComputerNameW,GetCurrentProcessId,RegOpenKeyW,RegOpenKeyW,RegCloseKey,NtQueryKey,NtQueryKey,RegCloseKey,RegOpenKeyW,NtQueryKey,RegCloseKey,NtCreateKey,NtOpenKey,NtQueryKey,CloseHandle,NtQueryAttributesFile,FileTimeToSystemTime,GetModuleHandleW,GetProcAddress,NtQueryInformationFile,SetLastError,CreateActCtxW,GetLastError,ConvertStringSecurityDescriptorToSecurityDescriptorW,		9_2_04E90B90
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E9CD00 VirtualAlloc,InterlockedCompareExchange,GetProcAddress,InterlockedCompareExchange,RtlAddVectoredExceptionHandler,		9_2_04E9CD00

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04E764A0 ReadProcessMemory,CreateFileW,ReadFile,ReadFile,SetFilePointer,ReadFile,CloseHandle,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,VirtualAllocEx,MapViewOfFile,UnmapViewOfFile,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetCurrentProcess,DuplicateHandle,GetLastError,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,VirtualAllocEx,GetLastError,WriteProcessMemory,GetLastError,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetLastError,GetCurrentProcess,DuplicateHandle,GetLastError,lstrlenW,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,lstrlenW,VirtualAllocEx,lstrlenW,WriteProcessMemory,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,CreateEventW,GetCurrentProcess,DuplicateHandle,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,VirtualProtectEx,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,GetCurrentThreadId,InterlockedCompareExchange,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForMultipleObjects,ResumeThread,

9_2_04E764A0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe "C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3017.tmp" "c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6262.tmp" "c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D8E.tmp" "c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP"

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: 9_2_04E94BD0 GetCurrentProcessId,wsprintfW,ConvertStringSecurityDescriptorToSecurityDescriptorW,ConvertStringSecurityDescriptorToSecurityDescriptorW,CreateMutexW,LocalFree,GetModuleHandleW,GetProcAddress,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,GetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorSacl,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,NtSetSecurityObject,NtSetSecurityObject,LocalFree,

9_2_04E94BD0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,

9_2_04E698C0

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\WinSxS\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-gb_0b85a8bb8c7e851a.manifest VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.WinForms.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.Core.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\SuWar3Tools\SuLibrary\SuLibrary.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.dll VolumeInformation

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Code function: 0_2_00445F06 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00445F06

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

9_2_04E90B90

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E8E010 BoxedAppSDK_IPC_RemoveListener,	9_2_04E8E010
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E8F960 BoxedAppSDK_IPC_AddListenerA,	9_2_04E8F960
Source: C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	Code function: 9_2_04E8F900 BoxedAppSDK_IPC_AddListenerW,	9_2_04E8F900

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Native API	1 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Virtualization/Sandbox Evasion	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	136 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002B_286.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	100%	Avira	HEUR/AGEN.1315051
C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	100%	Avira	HEUR/AGEN.1315051
C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\LisectAVT_2403002B_286.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cdn.ampproject.org/amp4ads-host-v0.js	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
http://.cdn.ampproject.netorg	0%	Avira URL Cloud	safe
https://api.bilibili.com/x/web-interface/zone	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.html_286.dlll	0%	Avira URL Cloud	safe
https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.debug.jsT	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/html/r20240723/r20110914/zrt_lookup.html	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.jsT	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.co	0%	Avira URL Cloud	safe
https://github.com/war3tools/war3tools.github.io/raw/master/docs/README.md	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.html	0%	Avira URL Cloud	safe
https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX)	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.jsT	0%	Avira URL Cloud	safe
http://boxedapp.com/boxedappsdk/order.htmlS:(ML;;NW;;;LW)U	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.jsT	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/favicon.ico	0%	Avira URL Cloud	safe
http://108955.kefu.easemob.com/v1/Tenant/108955/MediaFiles/6e07bc39-f04f-4785-8717-d6130c588db3U3VXY	0%	Avira URL Cloud	safe
https://eapi.pcloud.com/getapiserver	0%	Avira URL Cloud	safe
https://gitea.com/war3tools/war3tools/raw/branch/master/update.txtp	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.jsT	0%	Avira URL Cloud	safe
https://gitea.com/war3tools/war3tools/raw/branch/master/update.txt	0%	Avira URL Cloud	safe
https://war3tools.suyx.net	0%	Avira URL Cloud	safe
https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txt	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.debug.jsT	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.debug.jsT	0%	Avira URL Cloud	safe
https://dev.azure.com/war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c	0%	Avira URL Cloud	safe
https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png	0%	Avira URL Cloud	safe
https://fundingchoicesmessages.google.com/i/%	0%	Avira URL Cloud	safe
https://codeberg.org/war3tools/war3tools/raw/branch/master/README.md	0%	Avira URL Cloud	safe
https://sourceforge.net/projects/war3tools/files/	0%	Avira URL Cloud	safe
https://master.dl.sourceforge.net/project/war3tools/README.md?viasf=1	0%	Avira URL Cloud	safe
https://bitbucket.org/	0%	Avira URL Cloud	safe
https://drive.internxt.com/sh/folder/79ed1b38-26b8-4cbc-818e-5687b072eb1f/c0c84fdce9486632690de15d1e	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.jsT	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.debug.jsT	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.jsT	0%	Avira URL Cloud	safe
https://war3tools.github.io/update.txtp	0%	Avira URL Cloud	safe
https://master.dl.sourceforge.net/project/war3tools/SuWar3Tools.zip?viasf=1	0%	Avira URL Cloud	safe
https://www.google.com/adsense	0%	Avira URL Cloud	safe
https://gitea.com/war3tools/war3tools/raw/branch/master/README.mdlBcq	0%	Avira URL Cloud	safe
https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn)	0%	Avira URL Cloud	safe
https://gitea.com/war3tools/war3tools/raw/branch/master/README.md	0%	Avira URL Cloud	safe
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02Zj	0%	Avira URL Cloud	safe
https://nim-nosdn.netease.im	0%	Avira URL Cloud	safe
https://www.google.com/adsense/search/async-ads.js	0%	Avira URL Cloud	safe
https://www.google.com/adsense3	0%	Avira URL Cloud	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.debug.jsT	0%	Avira URL Cloud	safe
https://adsense.com.H	0%	Avira URL Cloud	safe
https://war3tools.gitlab.io/README.md	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com	0%	Avira URL Cloud	safe
http://.cdn.ampproject.netorgA	0%	Avira URL Cloud	safe
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxMjgxMTU3ODE4MV8xNDIwNjM4Zi0xZj	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.debug.jsT	0%	Avira URL Cloud	safe
https://war3tools.gitlab.io/update.txt	0%	Avira URL Cloud	safe
http://e.length	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.jsT	0%	Avira URL Cloud	safe
https://war3tools.gitlab.io/ad/banner.html	0%	Avira URL Cloud	safe
http://googleads.g.doubleclick.net	0%	Avira URL Cloud	safe
https://eapi.pcloud.com/getapiserverapihttps:///getpublinkdownload?fileid=fileid&hashCache=hash&code	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.jsT	0%	Avira URL Cloud	safe
https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txtp	0%	Avira URL Cloud	safe
https://adsense.com.b.google_ad_client	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.htmlmhq	0%	Avira URL Cloud	safe
https://gitlab.com/war3tools/war3tools.gitlab.io/-/blob/main/Others/ExtDll/README.md)	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.debug.jsT	0%	Avira URL Cloud	safe
https://github.com	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7779916227810877&output=html&adk=181227	0%	Avira URL Cloud	safe
https://e.lengthe.lengthe.lengthe.lengthe	0%	Avira URL Cloud	safe
https://googleads.g.doubleclick.net/pagead/html/	0%	Avira URL Cloud	safe
https://www.google.com/adsensentact	0%	Avira URL Cloud	safe
http://googleads.g.doubleclick.netLf.http://googleads.g.doubleclick.net	0%	Avira URL Cloud	safe
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	0%	Avira URL Cloud	safe
https://war3tools.gitlab.io	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.jsT	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.html...TU	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.jsT	0%	Avira URL Cloud	safe
http://google.com	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.html$	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/api2/aframe	0%	Avira URL Cloud	safe
https://war3tools.github.io/README.mdp	0%	Avira URL Cloud	safe
https://gitlab.com/war3tools/war3tools.gitlab.io	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.debug.jsT	0%	Avira URL Cloud	safe
https://www.google.com/s2/favicons?sz=64&domain_url=	0%	Avira URL Cloud	safe
https://ipinfo.io/json?token=166	0%	Avira URL Cloud	safe
https://war3tools.suyx.net/ad/header.html4	0%	Avira URL Cloud	safe
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=?download=SuWar3Tools.zip&randomtime=638574961174603590	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.jsT	0%	Avira URL Cloud	safe
https://cdn.ampproject.org/rtv/	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.jsT	0%	Avira URL Cloud	safe
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.debug.jsT	0%	Avira URL Cloud	safe
http://boxedapp.com/boxedappsdk/order.html	0%	Avira URL Cloud	safe
https://github.com/war3tools/war3tools.github.io/raw/master/docs/README.mdp	0%	Avira URL Cloud	safe
https://cse.google.com/cse.jsgoogle_wrap_fullscreen_adGoogle	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/war3tools/war3tools.github.io/master/docs/README.md	0%	Avira URL Cloud	safe
https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
war3tools.gitlab.io	35.185.44.232	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
visitor-badge.laobi.icu	119.28.77.158	true	false	unknown
master.dl.sourceforge.net	216.105.38.12	true	false	unknown
codeberg.org	217.197.91.145	true	false	unknown
github.com	140.82.121.4	true	false	unknown
raw.githubusercontent.com	185.199.110.133	true	false	unknown
hits.dwyl.com	172.67.187.145	true	false	unknown
dev.azure.com	13.107.42.20	true	false	unknown
war3tools.github.io	185.199.108.153	true	false	unknown
googleads.g.doubleclick.net	172.217.16.194	true	false	unknown
i.w.bilicdn1.com	148.153.35.66	true	false	unknown
nim-nosdn.netease.im.w.kunluncan.com	163.181.92.223	true	false	unknown
gitea.com	18.166.250.135	true	false	unknown
api.bilibili.com	unknown	unknown	false	unknown
war3tools.suyx.net	unknown	unknown	false	unknown
nim-nosdn.netease.im	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.bilibili.com/x/web-interface/zone	false	Avira URL Cloud: safe	unknown
https://github.com/war3tools/war3tools.github.io/raw/master/docs/README.md	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.html	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/favicon.ico	false	Avira URL Cloud: safe	unknown
https://codeberg.org/war3tools/war3tools/raw/branch/master/README.md	false	Avira URL Cloud: safe	unknown
https://master.dl.sourceforge.net/project/war3tools/README.md?viasf=1	false	Avira URL Cloud: safe	unknown
https://gitea.com/war3tools/war3tools/raw/branch/master/README.md	false	Avira URL Cloud: safe	unknown
https://war3tools.gitlab.io/ad/banner.html	false	Avira URL Cloud: safe	unknown
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=?download=SuWar3Tools.zip&randomtime=638574961174603590	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/war3tools/war3tools.github.io/master/docs/README.md	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://.cdn.ampproject.netorg	LisectAVT_2403002B_286.exe, 00000000.00000003.2651989893.0000000013977000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651574314.0000000013973000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651194631.0000000013970000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651704249.0000000013975000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651440514.0000000013972000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2651835940.0000000013976000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.co	csc.exe, 0000001C.00000002.3298788163.0000000004AF5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.html_286.dlll	LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/html/r20240723/r20110914/zrt_lookup.html	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646639347.000000000F532000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655068073.000000000F53D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646717732.000000000F534000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646680239.000000000F533000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646601399.000000000F531000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://boxedapp.com/boxedappsdk/order.htmlS:(ML;;NW;;;LW)U	LisectAVT_2403002B_286.exe	false	Avira URL Cloud: safe	unknown
http://108955.kefu.easemob.com/v1/Tenant/108955/MediaFiles/6e07bc39-f04f-4785-8717-d6130c588db3U3VXY	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX)	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitea.com/war3tools/war3tools/raw/branch/master/update.txtp	LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://eapi.pcloud.com/getapiserver	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fundingchoicesmessages.google.com/i/%	f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://gitea.com/war3tools/war3tools/raw/branch/master/update.txt	LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txt	LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.azure.com/war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c	LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ampproject.org/amp4ads-host-v0.js	LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	false	URL Reputation: safe	unknown
https://sourceforge.net/projects/war3tools/files/	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/adsense	LisectAVT_2403002B_286.exe, 00000000.00000003.2633122649.000000000A1FE000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671937255.000000000A258000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671670121.000000000A205000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitbucket.org/	LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.github.io/update.txtp	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.internxt.com/sh/folder/79ed1b38-26b8-4cbc-818e-5687b072eb1f/c0c84fdce9486632690de15d1e	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://master.dl.sourceforge.net/project/war3tools/SuWar3Tools.zip?viasf=1	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitea.com/war3tools/war3tools/raw/branch/master/README.mdlBcq	LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn)	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://adsense.com.H	LisectAVT_2403002B_286.exe, 00000000.00000003.2603215891.000000001387F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2608253242.0000000013880000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2607708668.000000001387F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02Zj	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mathiasbynens.be/	f[1].txt.0.dr	false	URL Reputation: safe	unknown
https://nim-nosdn.netease.im	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FEE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/adsense/search/async-ads.js	LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F87000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633370663.0000000013EF6000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633547622.0000000013EF8000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp, f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.gitlab.io/README.md	LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/adsense3	LisectAVT_2403002B_286.exe, 00000000.00000003.2654589142.00000000139B6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.cdn.ampproject.netorgA	LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.0000000010713000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.jsT	csc.exe, 00000016.00000002.3134952936.00000000052C8000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3267235462.0000000005108000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3297447721.0000000004AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nim-nosdn.netease.im/MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxMjgxMTU3ODE4MV8xNDIwNjM4Zi0xZj	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://googleads.g.doubleclick.net	f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://war3tools.gitlab.io/update.txt	LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2760838359.0000000002E0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2869908564.0000000002D3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://e.length	LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://eapi.pcloud.com/getapiserverapihttps:///getpublinkdownload?fileid=fileid&hashCache=hash&code	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.jsT	csc.exe, 00000016.00000003.3125138951.00000000052ED000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125791799.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125381458.00000000052F1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3130968893.00000000052F5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3135656929.00000000052F6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://codeberg.org/war3tools/war3tools/raw/branch/master/update.txtp	LisectAVT_2403002B_286.exe, 0000000A.00000002.2811483163.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitlab.com/war3tools/war3tools.gitlab.io/-/blob/main/Others/ExtDll/README.md)	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://adsense.com.b.google_ad_client	LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.htmlmhq	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000003021000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002F3A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/json	csc.exe, 00000019.00000003.3251655485.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251370768.00000000051A5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3252719149.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3244944307.000000000512C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3251655485.0000000005178000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3262862553.00000000050C1000.00000004.00001000.00020000.00000000.sdmp, zkeqnbkw.0.cs.13.dr	false	URL Reputation: safe	unknown
https://e.lengthe.lengthe.lengthe.lengthe	LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7779916227810877&output=html&adk=181227	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.00000000033C3000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2656788771.000000000F2C4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://googleads.g.doubleclick.netLf.http://googleads.g.doubleclick.net	LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://googleads.g.doubleclick.net/pagead/html/	LisectAVT_2403002B_286.exe, 00000000.00000003.2609031626.000000001071F000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2633008327.0000000013F25000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2609240005.0000000013EB1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671207941.0000000013F37000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2587061684.000000000A1FF000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	LisectAVT_2403002B_286.exe, 00000000.00000003.2633008327.0000000013F25000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2673165753.0000000013FA0000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/adsensentact	LisectAVT_2403002B_286.exe, 00000000.00000003.2633122649.000000000A1FE000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671937255.000000000A258000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2671670121.000000000A205000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com	f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://war3tools.gitlab.io	header[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.jsT	csc.exe, 00000016.00000002.3134952936.00000000052C8000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3267235462.0000000005108000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3297447721.0000000004AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.html...TU	LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000C50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.html$	LisectAVT_2403002B_286.exe, 00000000.00000003.2656788771.000000000F2C4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/aframe	LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://gitlab.com/war3tools/war3tools.gitlab.io	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.github.io/README.mdp	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/s2/favicons?sz=64&domain_url=	f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/json?token=166	csc.exe, 00000019.00000003.3251655485.0000000005189000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3252719149.0000000005189000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://war3tools.suyx.net/ad/header.html4	LisectAVT_2403002B_286.exe, 00000000.00000003.2646949285.000000000F855000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2656752164.000000000F856000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268304624.0000000005138000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3264153006.0000000005137000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256602548.0000000005136000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255850280.000000000512F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3256347115.0000000005134000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000002.3298644035.0000000004AE5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291293637.0000000004ADC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3291521114.0000000004AE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ampproject.org/rtv/	LisectAVT_2403002B_286.exe, 00000000.00000003.2673483757.0000000013F2C000.00000004.00000020.00020000.00000000.sdmp, f[1].txt.0.dr	false	Avira URL Cloud: safe	unknown
http://boxedapp.com/boxedappsdk/order.html	LisectAVT_2403002B_286.exe, 00000000.00000002.2701846576.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, LisectAVT_2403002B_286_Update.exe, 00000009.00000002.2762718857.0000000006310000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286.exe, 0000000A.00000002.2815350308.00000000062F0000.00000004.10000000.00040000.00000000.sdmp, LisectAVT_2403002B_286_Update.exe, 0000000B.00000002.2872643403.00000000062A0000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.debug.jsT	csc.exe, 00000016.00000003.3124897434.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000002.3136111326.0000000005306000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3125692919.0000000005305000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124796351.0000000005301000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000016.00000003.3124298894.00000000052F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000002.3268436314.0000000005146000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3255447999.0000000005144000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000019.00000003.3254495460.000000000513C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3282791615.0000000004AE9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3283855512.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3292581729.0000000004AF7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 0000001C.00000003.3284044089.0000000004AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/war3tools/war3tools.github.io/raw/master/docs/README.mdp	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cse.google.com/cse.jsgoogle_wrap_fullscreen_adGoogle	LisectAVT_2403002B_286.exe, 00000000.00000003.2646768862.000000000F535000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646639347.000000000F532000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2655068073.000000000F53D000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646717732.000000000F534000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646680239.000000000F533000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002B_286.exe, 00000000.00000003.2646601399.000000000F531000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX	LisectAVT_2403002B_286.exe, 00000000.00000002.2704547420.0000000002FBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.105.38.12	master.dl.sourceforge.net	United States	6130	AIS-WESTUS	false
13.107.42.20	dev.azure.com	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.185.44.232	war3tools.gitlab.io	United States	15169	GOOGLEUS	false
185.199.108.153	war3tools.github.io	Netherlands	54113	FASTLYUS	false
172.217.16.194	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
18.166.250.135	gitea.com	United States	16509	AMAZON-02US	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
148.153.35.66	i.w.bilicdn1.com	United States	63199	CDSC-AS1US	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
163.181.92.223	nim-nosdn.netease.im.w.kunluncan.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
217.197.91.145	codeberg.org	Germany	29670	IN-BERLIN-ASIndividualNetworkBerlineVDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1481863
Start date and time:	2024-07-25 15:15:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002B_286.exe
Detection:	MAL
Classification:	mal69.expl.evad.winEXE@24/35@25/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 453 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, msedgewebview2.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.68, 20.190.159.4, 40.126.31.71, 20.190.159.73, 20.190.159.71, 20.190.159.0, 20.190.159.75, 40.126.31.67, 142.250.185.194, 13.107.42.16, 142.250.184.226, 20.56.187.20, 20.191.45.158
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, nav-edge.smartscreen.microsoft.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, data-edge.smartscreen.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, pagead2.googlesyndication.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, tm-prod-wd-csp-edge.trafficmanager.net, ocsp.digicert.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, prod-agic-we-3.westeurope.cloudapp.azure.com, l-0007.l-msedge.net, config.edge.skype.com, prod-agic-ne-1.northeurope.cloudapp.azure.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LisectAVT_2403002B_286.exe

Simulations

Behavior and APIs

Time	Type	Description
09:16:57	API Interceptor	981757x Sleep call for process: LisectAVT_2403002B_286.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.105.38.12	PeaceSetup.exe	Get hash	malicious	Unknown	Browse
185.199.108.153	http://auth-trezor.github.io/	Get hash	malicious	Unknown	Browse	auth-trezor.github.io/
	http://arijitarz.github.io/netflix/	Get hash	malicious	Unknown	Browse	arijitarz.github.io/netflix/
	http://abhay-panchal-14.github.io/netflix	Get hash	malicious	Unknown	Browse	abhay-panchal-14.github.io/netflix
	http://aks34.github.io/NETFLIX_CLONE/	Get hash	malicious	Unknown	Browse	aks34.github.io/NETFLIX_CLONE/
	http://andrepolanco.github.io/facebook.github.io/	Get hash	malicious	Unknown	Browse	andrepolanco.github.io/facebook.github.io/
	http://best-practice-and-impact.github.io/govcookiecutter/	Get hash	malicious	Unknown	Browse	best-practice-and-impact.github.io/govcookiecutter/
	http://subhalaxmi2000.github.io/netflixclone	Get hash	malicious	Unknown	Browse	subhalaxmi2000.github.io/netflixclone
	http://theabhiichakraborty.github.io/netflix-clone	Get hash	malicious	Unknown	Browse	theabhiichakraborty.github.io/
	http://janhavikodape.github.io/Netflix-Clone	Get hash	malicious	Unknown	Browse	janhavikodape.github.io/Netflix-Clone
	http://fix-to-manage-1.github.io/Submit-apply-1	Get hash	malicious	HTMLPhisher	Browse	fix-to-manage-1.github.io/Submit-apply-1
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
148.153.35.66	SlHgSOYcMY.exe	Get hash	malicious	Unknown	Browse	passport.bilibili.com/phpMyAdmin/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
codeberg.org	CNWSFY59Z6S1D.JS	Get hash	malicious	WSHRAT	Browse	217.197.91.145
	CNWSFY59Z6S1D.JS	Get hash	malicious	WSHRAT	Browse	217.197.91.145
	6Y8CXBW7P6AR.JS	Get hash	malicious	Unknown	Browse	217.197.91.145
	Techspan Statement.xlsm	Get hash	malicious	Unknown	Browse	217.197.91.145
chrome.cloudflare-dns.com	LisectAVT_2403002B_360.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	LisectAVT_2403002B_404.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	LisectAVT_2403002B_404.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	LisectAVT_2403002B_428.exe	Get hash	malicious	Coinhive, Ramnit, Xmrig	Browse	162.159.61.3
	LisectAVT_2403002C_110.dll	Get hash	malicious	Ramnit	Browse	172.64.41.3
	LisectAVT_2403002C_110.dll	Get hash	malicious	Ramnit	Browse	172.64.41.3
	LisectAVT_2403002C_123.exe	Get hash	malicious	Bdaejec, Darkbot	Browse	172.64.41.3
	LisectAVT_2403002C_124.exe	Get hash	malicious	Bdaejec, Ramnit	Browse	162.159.61.3
	LisectAVT_2403002C_134.exe	Get hash	malicious	Ramnit	Browse	172.64.41.3
	KolataFixed.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
visitor-badge.laobi.icu	6IvqTafV8y.exe	Get hash	malicious	RedLine	Browse	119.28.77.158
	6IvqTafV8y.exe	Get hash	malicious	RedLine	Browse	119.28.77.158
	SuWar3Tools.exe	Get hash	malicious	RedLine	Browse	119.28.77.158
	SuWar3Tools.exe	Get hash	malicious	RedLine	Browse	119.28.77.158
	tDkUqzi4PG.exe	Get hash	malicious	AgentTesla, Amadey, AsyncRAT, Fabookie, Lokibot, LummaC Stealer, RHADAMANTHYS	Browse	119.28.77.158
raw.githubusercontent.com	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.111.133
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.108.133
	Lisect_AVT_24003_G1B_83.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Lisect_AVT_24003_G1B_95.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	LisectAVT_2403002A_392.exe	Get hash	malicious	NovaSentinel	Browse	185.199.109.133
	LisectAVT_2403002A_260.exe	Get hash	malicious	Python Stealer, Blank Grabber, Rose Stealer, Xmrig	Browse	185.199.110.133
	https://voice-ourtime.ifoselovec.workers.dev/?notrack	Get hash	malicious	HTMLPhisher	Browse	185.199.111.133
	8998BC9FAF52DAB072698E932593819BFD772EE5C0C4519F30ECD55DE363505A.exe	Get hash	malicious	Bdaejec	Browse	185.199.110.133
github.com	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://forms.office.com/Pages/ResponsePage.aspx?id=BqNskUxs8U6nXGGZ_4IjJrg09W7G0L5Pruu0tOeqXPNUMVdNUUg1OEZaVjM1NDA4MDU1QlFHUlhGSy4u	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	FBD0DD6CFA4C80E07EDB97767D169EC45066A58B9D2FD475BE13BC4A7CC4DFA2.exe	Get hash	malicious	Bdaejec	Browse	140.82.121.3
	parcellabelphoto.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
	http://links-sg.dispatch.me/ls/click?upn=u001.ocQe0-2BgliqpF-2FIgZypM8KOaLflKjBlvqTxtPZw5yZIbZDE9vmulRwrCjHKmWRDNHjHXGC5bjX16p-2FKQbudETcReyH2ada0TDTZ9i4Fm9kQ3GWUyvzzwMCdcEUqs-2FTSCobKxgzuisHVBsQ-2FSQ3F13H5HutCQALtWrS8HApt5o4dpZ-2BNvuOuxFwx-2BeObsn6VjvT5TqPLkexi4iH5KEJi8Cdw-3D-3DATrr_-2F-2F-2B-2FxnH7VwZ7l1bJN-2FhVOPk1U24fPXiT0lCeCqmBBxzunHzzBZhASjEPhdfcYmgfhvKPgbmfCcNO0asuCAP4GQjxIDFltQt0zztHT0pZkzXqKtFgdxgdlGrzT0WJ21THn3P5UyhAiKGRx3slicqJyrWBw4wmTjosxdLpPvzT9mOZ9tFtj-2FYpdJbLEVcqfFG3PWdvMJHnhRGcQ-2BjkZifTwg-3D-3D	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	Transaction record 5445-97660.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	Transaction record 5445-97660.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
master.dl.sourceforge.net	PeaceSetup.exe	Get hash	malicious	Unknown	Browse	216.105.38.12

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AIS-WESTUS	QRE3h2SSev.elf	Get hash	malicious	Mirai, Gafgyt	Browse	173.213.255.227
	https://sourceforge.net/projects/docfetcher/files/docfetcher/1.1.25/docfetcher_1.1.25_win32_setup.exe/download	Get hash	malicious	Unknown	Browse	204.68.111.105
	https://winscp.net/eng/download.php	Get hash	malicious	Unknown	Browse	216.105.38.9
	https://survey.nationalopinioninstitute.com/hP7nk	Get hash	malicious	Unknown	Browse	67.207.214.123
	MDE_File_Sample_0e9d1c53bfb8f43b777a5c0e25f0a850e1a521b3.zip	Get hash	malicious	Unknown	Browse	204.68.111.105
	fQJ7EENUSV.elf	Get hash	malicious	Mirai	Browse	173.213.244.46
	https://bestandssm.xyz/product_details/3974767.html	Get hash	malicious	Unknown	Browse	67.207.212.195
	Kqm2EouJ6h.elf	Get hash	malicious	Mirai	Browse	209.59.60.117
	iojdGF3xsj.elf	Get hash	malicious	Mirai	Browse	173.213.255.210
	http://downloads.sourceforge.net/project/antinat/antinat/0.80/antinat.exe?r=http://downloads.sourceforge.net%5C%5Cu0026ts=gAAAAABkZuiIhoazbWL92yvXzZfWPjIb3SxTRRBpH08osl0Ud-g8e-YuAxCnFkvJl0mia8g-oUDq3KZG7WEmAsgFTRcfmQseng==%5C%5Cu0026use_mirror=gigenet	Get hash	malicious	Unknown	Browse	216.105.38.9
MICROSOFT-CORP-MSN-AS-BLOCKUS	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	204.79.197.203
	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	13.107.246.42
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	13.107.246.60
	LisectAVT_2403002B_359.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	LisectAVT_2403002B_360.exe	Get hash	malicious	Unknown	Browse	204.79.197.239
	https://www.bing.com/search?pglt=163&q=bosphorus+speisekarte&cvid=3b61922a022645c18ea2d78b42ef8c11&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIGCAEQABhAMgYIAhAAGEDSAQg0NjQ3ajBqMagCCLACAQ&FORM=ANNTA1&PC=U531	Get hash	malicious	Unknown	Browse	150.171.29.10
	http://www.cabrerallamas.com/	Get hash	malicious	Unknown	Browse	13.107.246.42
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	HTMLPhisher	Browse	204.79.197.203
AMAZON-02US	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	18.141.10.107
	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	34.252.40.201
	LETTER.pdf	Get hash	malicious	Unknown	Browse	18.239.83.16
	http://www.cabrerallamas.com/	Get hash	malicious	Unknown	Browse	18.158.75.66
	http://ads.livetv799.me	Get hash	malicious	Unknown	Browse	108.156.64.41
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	HTMLPhisher	Browse	18.245.86.89
	LisectAVT_2403002B_404.dll	Get hash	malicious	Ramnit	Browse	18.239.83.98
	phish_alert_sp2_2.0.0.0 (27).eml	Get hash	malicious	HTMLPhisher	Browse	18.239.18.33
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	18.163.247.76
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	13.227.219.97
FASTLYUS	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	151.101.129.181
	http://tamu.perksconnect.com	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://pub-25902d32074b459eb837a12ad320b79e.r2.dev/index.html#gusquast@bitel.net	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	151.101.2.137
	LisectAVT_2403002B_428.exe	Get hash	malicious	Coinhive, Ramnit, Xmrig	Browse	151.101.66.137
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.111.133
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.108.133
	LisectAVT_2403002C_110.dll	Get hash	malicious	Ramnit	Browse	151.101.130.137
	LisectAVT_2403002C_110.dll	Get hash	malicious	Ramnit	Browse	151.101.130.137
	LisectAVT_2403002C_123.exe	Get hash	malicious	Bdaejec, Darkbot	Browse	151.101.194.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_323.exe	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_321.exe	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_359.exe	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_385.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_390.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_395.exe	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	httP://151.28.168.184.host.secureserver.net/documento=24/07/2024/U04cVk3Ovkp..VkcI/6VnUVdvU8k1Oz8c2H4/maud.gaume@gmail.com-282072__;!!P3IToRM6tg!mhHYI3NP1FN47238PV4Ejpyi3ZOkGxwJydSJnD9HyjmCKYq9ZCB_iRj7Oz_yw96WdDsvl9wksR7V4C9z2rZDtUTV_FwEQ6ffgUAMko4$	Get hash	malicious	Unknown	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	216.105.38.12 13.107.42.20 35.185.44.232 185.199.108.153 18.166.250.135 140.82.121.4 148.153.35.66 185.199.110.133 163.181.92.223 217.197.91.145
37f463bf4616ecd445d4a1937da06e19	LisectAVT_2403002B_272.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	35.185.44.232
	LisectAVT_2403002B_295.exe	Get hash	malicious	Unknown	Browse	35.185.44.232
	LisectAVT_2403002B_295.exe	Get hash	malicious	Unknown	Browse	35.185.44.232
	LisectAVT_2403002B_311.exe	Get hash	malicious	XRed	Browse	35.185.44.232
	LisectAVT_2403002B_318.exe	Get hash	malicious	XRed	Browse	35.185.44.232
	LisectAVT_2403002B_327.exe	Get hash	malicious	XRed	Browse	35.185.44.232
	LisectAVT_2403002B_331.exe	Get hash	malicious	Unknown	Browse	35.185.44.232
	LisectAVT_2403002B_343.exe	Get hash	malicious	XRed	Browse	35.185.44.232
	LisectAVT_2403002B_344.exe	Get hash	malicious	Bdaejec, Vidar	Browse	35.185.44.232
	LisectAVT_2403002B_356.exe	Get hash	malicious	Unknown	Browse	35.185.44.232

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2124
Entropy (8bit):	5.354836459581629
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HKHKMRmHKU57UiHZH1HxHK9HKs:Pq5qHwCYqh3oPtI6eqzxqqMRmqU57Uim
MD5:	02DFBEF05C485C265F36615D30B2D849
SHA1:	E2FBE7962DC294E6C7099CB8E00F4BC1C4E3C07C
SHA-256:	11D5B0D32644193B5524464D5DF500901D94C2F1A65F258D205299759E1FE1C5
SHA-512:	2F10DAACE3BE96997D9E95644BACBC5230CF02FEC10C506C531B0C199329DA004579E44278C003EB569BE4BF68F51FEFDFF4CE6BD171E54584377854B5B3AF88
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_286_Update.exe.log

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLUE4K5E4KH1qE4j
MD5:	64A2247B3C640AB3571D192DF2079FCF
SHA1:	A17AFDABC1A16A20A733D1FDC5DA116657AAB561
SHA-256:	87239BAD85A89EB90322C658DFD589B40229E57F05B181357FF834FCBABCB7E2
SHA-512:	CF71FE05075C7CAE036BD1B7192B8571C6F97A32209293B54FAEC79BAE0B6C3369946B277CE2E1F0BF455BF60FA0E8BB890E7E9AAE9137C79AB44C9C3D406D35
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\5LOESKIH\war3tools.suyx[1].xml

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\f[1].txt

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	ASCII text, with very long lines (1913)
Category:	dropped
Size (bytes):	504801
Entropy (8bit):	5.566026845169729
Encrypted:	false
SSDEEP:	6144:fDYp/aDtk3u1lqItor3jHJ32KyqhfSjHO3SVwOu5C1Tnyl2mm:fnD31lqItor3FmPqh6jHOiVwOudzm
MD5:	FD18E3F0754CCC63F87546C040F4F623
SHA1:	BB09F80EC02C22C3015C44B90EEBACF989F1950E
SHA-256:	1D87A150B56139B547124B32DA191882709D1CE8EB8666C336E625B5530C23C0
SHA-512:	B17E258B0849CFFF7EB370BD026FEC546C5372F6F7EC453D74EA3D195A2A3A368B042C0453D28906BD892CE72C35AEDD40BA5823892E0085E1670F504797FAE8
Malicious:	false
Preview:	(function(sttc){var t,aa;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=fa(this),ja=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",u={},ka={};function w(a,b,c){if(!c\|\|a!=null){c=ka[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function x(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in u?f=u:f=ha;for(e=0;e<d.length-1;e++){var h=d[e];if(!(h in f))break a;f=f[h]}d=d[d.length-1];c=ja&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?ea(u,d,{configurable:!0,writable:!0,value:b}):b!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\f[1].txt

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	ASCII text, with very long lines (3450)
Category:	dropped
Size (bytes):	191874
Entropy (8bit):	5.56835387113054
Encrypted:	false
SSDEEP:	1536:L1EzIIhaccMoFNFfc0UL1CTVmkIpH40D/6A1slHiGIf5uLtf9ZN4X7lmWCOWza99:2vcWlV3i9iLou7lGzWpPvgRn9QM4
MD5:	8F54559915B96B095977583C3350AD85
SHA1:	9071C108D9E91D704FBBE20DA62E508C7E549B8E
SHA-256:	4B44672BD0798139FCEC7A6AAA688102B06530430A54A6492F5216D85534A4B6
SHA-512:	CFA462564A1C3BE928653F8E6F8661CD1865A4DC3F5529EAD2E754CD4F8B29EAAFBA2894F3E7A02D77B2A0B97041A6F2FA35A55BE566052764071804AD1B31A7
Malicious:	false
Preview:	(function(sttc){var r,aa;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ea=da(this),fa=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},ha={};function u(a,b,c){if(!c\|\|a!=null){c=ha[b];if(c==null)return a[b];c=a[c];return c!==void 0?c:a[b]}} .function w(a,b,c){if(b)a:{var d=a.split(".");a=d.length===1;var e=d[0],f;!a&&e in t?f=t:f=ea;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=fa&&c==="es6"?f[d]:null;b=b(c);b!=null&&(a?ca(t,d,{configurable:!0,writable:!0,value:b}):b!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=[1].cache

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	4041269
Entropy (8bit):	7.998814477689635
Encrypted:	true
SSDEEP:	98304:MGg4C5HvfQ1BpKuDEE7e6y0cmhVRgfrSH1bpMjaKm3hvr:MGg4cgBpvYE7Fgj/aKmhz
MD5:	8BB2586F9577A9D12A4D93478367F06E
SHA1:	ABF8D1EE99D631901E823F030F82E28D01FC4DC8
SHA-256:	91DEB530D2B0D3E8458D6E93D86E1522DC9E4EBFA805C21A38E96FC14622E15D
SHA-512:	338F0B19DDD2463D9DD9B168167421EA496030072F8E50EF2EF6050B7549C357495602373C79BC436276BA7F1B3DA1B1FB931E456BD9523962CF99C0CD9FC148
Malicious:	false
Preview:	PK...........W................SuWar3Tools/PK........x..X.;...=...P.....SuWar3Tools/SuWar3Tools.exe..XT..8\|.9.(.g.A)IG.....5l..W.:..j~P.Dde:..."4..7SVTZ......W.:......GW.. T`&h......aP+...}~..O....>k....k...Yk95.q<..2..s.....'..z............L.\|x.a....Z\|.............;.3<..!vZ...../..{7.....qI. ...H...in.X..8] ..A...C+upa.d..k.k7.u.r....`H..h.u......_..x.\,.p..7....$^..3hg..;..3.`..{.-P.K`.!.....x....9..Q...V...@.1.Y1.mE/.....U~;.s.OH....g.r\.-.....-.....'...c....sm...,~..)...\.fX.)........._..>.}.........._..>........+=..XI...-.A..q.d....F...d....).[.s.;>D.,...@&....7.!9K.;....H+s6i...m..L.,.X.n.[..UN..VcI..DL.....n.Z..d...N.5j!;..!'.,.$......D^\.i.0..........c.s...J..=.;......5.......L.2z...........h.*.u.R....j....K.u....."........O.`...?i....Zlr....Q........n..jE+....;...>.Zd2..L.."-.)J........lh......M...}.399$v V1...w....1T./...h..$.>9.K...aR....F.P`...kJ.s.3(.`M'-..>..'AP:.".......=3onG..Q...4.s..eqV.X..q....ko...&...mP...............?hr....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\header[1].htm

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1888
Entropy (8bit):	5.6052549272408845
Encrypted:	false
SSDEEP:	48:zcx8Ep+o637Yd9Jtio5n+tISjxRbbN+f79W6T:zcx8Ekow89R+BbbpoF
MD5:	63E9D035971EE95334174931F05B4C40
SHA1:	5F9CDC7EF00DCF893AD5441C0B8C7A4A7D3DD044
SHA-256:	A1A4B2AEC484A93BA52FF2D4C2684185F94E416A5556AD49B81F4A4FC690F252
SHA-512:	78AB7168F617179C69C93A9188122274F4E7A85E8F305C31ACF7DFEE35B92931AA2B288B613470C416693DC62E257B43174E703349AC89CE1AA8F00BB90DA533
Malicious:	false
Preview:	.<!DOCTYPE html>.<head>. <title>....3..SuWar3Tools</title>. <meta charset="UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">. <meta name="description" content="....3..SuWar3Tools">. <meta name="keywords" content="....3..SuWar3Tools,....,Warcraft III,war3,wc3,SuWar3Tools,..,..,..,..">. <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">. <style>. body {. background: #ffffff;. margin: 0px;. }. .headerad {. text-decoration: none;. position: relative;. }. .headerad:before {. background: linear-gradient(to left bottom, hsl(99, 100%, 85%) 0%,hsl(226, 100%, 85%) 100%);. content: '\9b54\517d\4e89\9738\0033\6539\952e\0053\0075\0057\0061\0072\0033\0054\006f\006f\006c\0073\ahttps://war3tools.gitlab.io';. white-space: pre;. display: flex;. justify-content: center;. align-items: center;. height: 100%;.

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.0.cs

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18514
Entropy (8bit):	4.31841024179425
Encrypted:	false
SSDEEP:	192:iuNWs4b6fYymynjFmZP/G3wZ8PK8P5TXXUFaJXV3feaK0K3jh1aK053MLY/t:iuMsYAuNG3OeKelXUgXlfU3m31t
MD5:	3E3AD712B18F4BF1494DD5A39204F477
SHA1:	F2F5362F2393FC6B4B2360B7B5FECD88C002D71E
SHA-256:	52F8717C77C5D5C72366DB9085E22E5A7E2BA702115EBD0FF861913179DB6401
SHA-512:	B873F6ED382BCD2A912736C120E251B271BF5F2948C5AA320FF063A3B4B67114C5C3CC566766C1F5970B40334842BC8B1173DB3DD782A454B36C133293A77D5C
Malicious:	false
Preview:	.using System;.using System.Collections;.using System.Collections.Generic;.using System.IO;.using System.IO.Compression;.using System.Linq;.using System.Net;.using System.Net.Http;.using System.Net.Http.Headers;.using System.Text;.using System.Threading.Tasks;.using System.Web.Script.Serialization;.namespace MyCompiler_NameSpace {.public class MyCompiler_Class {.static MyCompiler_Class().. {.. //...................: .... SSL/TLS ....... System.Net.ServicePointManager.Expect100Continue = true;.. System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12 \| System.Net.SecurityProtocolType.Tls11 \| System.Net.SecurityProtocolType.Tls;.. System.Net.ServicePointManager.ServerCertificateValidationCallback = (sender1, certificate, chain, errors) => true;.. }.public object GetMyObject(Dictionary<string, string> dics).{.var url =

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (334), with no line terminators
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.160973866204088
Encrypted:	false
SSDEEP:	6:pAu+HIWdyrL/6KewqWVAVMZO/AuA5LXxZ923fjH8OHAzxszI923fjH8OHLGAn:p3xrL/6KeqAmZO/Au0Txecw5
MD5:	1A66DD7154FB612CAC187E119424ABFC
SHA1:	24CF861EC096DF375F55C0BD45126CCF77F7C945
SHA-256:	D2D466D128C62C1A6D04B5578C1B190701752DD84CF32F900658A1CBC39D7F8C
SHA-512:	D9A62B04D8245146069C7F8EA46C7BB85C4F8D8FF42477854CB766BBFDDA900C81042A7DAFDB2F3F8AF7CFD9D55D2BF3F072554C101B243AE16DA14B615D5960
Malicious:	false
Preview:	./t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.0.cs"

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.4822279068317705
Encrypted:	false
SSDEEP:	384:33y8ZtEjWHpweuj2HCd+XrYGefz8CIIhZpmG+tc+6gcE42ae1:3i8ZtEOmjxdAaz8CbLKY2ae1
MD5:	31AFAC6E3780E370DFBA935E335765C3
SHA1:	8D1A84D6DFF2ED3C41672AEC419A156CA8CD4D56
SHA-256:	6AF00A10F2CCA6BB66E891ADEA0BFE74C9E6549C180F59C44CC9685D78EA0F1C
SHA-512:	A62A4BA85854647135787C04D801CCDF4BF7DFBFF54E8AD7FE662499C96CFCD298113AAF81F6AB290EF4D7B8EBBCCC78A984DA918968AFBCF6FCFD8D009C7592
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%l.f...........!.....T...........s... ........... ....................................@.................................Ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......@D.../..............................................................(.... ....(....~....-........s.........~....(......0..-.......r...p.s......rW..p...r_..p..(....o.....(...+....0.................(....&....&......................0.................(....&....&.......................(....-..,..o.....2...o....-.rg..p..o....%-.&rg..p....0..X........(....-..(....,.rg..p.ri..po....,.s.....(...+....(....s.....(...+.o....t........(.....0...........,..o.....2..(....,.

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.out

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (415), with CRLF, CR line terminators
Category:	modified
Size (bytes):	836
Entropy (8bit):	5.292196234362425
Encrypted:	false
SSDEEP:	24:KMoqddj6KeSZO/A3ed8Kax5DqBVKVrdFAMBJTH:dosj6dSZmA3ed8K2DcVKdBJj
MD5:	DC9EC473B3F14ED12E77D4377D039057
SHA1:	70554B44719DB4E1E0B8270B4A360C3C45E9C19F
SHA-256:	CC2CCC10E0A842FB25EDFBDEA56631E17FA250AC7993BDA8460EA1A6A8C2242F
SHA-512:	489C7EDF58A69FB058009E7EEDB7904D56C5345D25A6408B9EA2C7DE116DA8C5CE6411B866A553B1957B3521ECDDA0B9225532758B47DCFE6474D719867B8563
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1209049775152384
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryuak7YnqqMPN5Dlq5J:+RI+ycuZhNwakSMPNnqX
MD5:	0D11A6876D6D879572BE150B5DD21C73
SHA1:	CED563DDA5393C5EF1D3CAA4EF138CBC575323F2
SHA-256:	8E496B809F7E3D2B4903CE734B205568B28131D4D42CC71BFA0FFCD166FBC78F
SHA-512:	7F8F01405458298AF8ADF9DC9C4B39BC47956A30DDCD347959CB4FF602DE31575F6C9331D15A97A39D46888C7BBB09EA341D5F15580B57F28A9AA340DDAF9486
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.k.j.w.n.q.t.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.k.j.w.n.q.t.4...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES3017.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Thu Jul 25 15:15:33 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.9785116482320926
Encrypted:	false
SSDEEP:	24:H+6m9pvHPwZHqwKTFexmfwI+ycuZhNtYakS6NPNnqSSd:etvvwZhKTAxmo1ultYa36XqSC
MD5:	BDE441FE89D8F02D7718AD9DB9059BF1
SHA1:	79315C05FA63F9E6CADDB6389545A8753D926F57
SHA-256:	41C60B6B255F001F0DA244EF38520A795AA50B71DD8649FF5AB23395B98F3DA6
SHA-512:	12921CB2BF765AA02E7A79F94F64F8141578BADFF11DAD027DF434B6D280AD29D47CEF488C9BAC5E39DA9643377A9BF279A12FEC625FCC76B4829863B0F552E8
Malicious:	false
Preview:	L....l.f.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP..................\.....9.4(l}11%...........5.......C:\Users\user\AppData\Local\Temp\RES3017.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.r.v.3.3.q.4.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\RES6262.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Thu Jul 25 15:15:46 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	4.014149369692774
Encrypted:	false
SSDEEP:	24:HyzW9164tHhwKTFexmfwI+ycuZhN85GakSv5XPNnqS2d:E6qKTAxmo1ul8Ea3vrqSG
MD5:	6DBCB91638BE2E5EE9C7006504C06C7D
SHA1:	9A607211847D3D1925B91AC9BC8629B921248710
SHA-256:	85CE4257B86C17189D5EB023FF72808C2895A64A2567AD4551447C39BFE02411
SHA-512:	369A7C3A27443C3E9FF4EA9A0B8E008E314D7DE32512E0761139FDF3BA2AAD5B4BF6A3473904F6962B54E562B32620929CD32D20B2859718E6DEF7710B51D3A2
Malicious:	false
Preview:	L..."l.f.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP.......................N.W..{...........5.......C:\Users\user\AppData\Local\Temp\RES6262.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.k.e.q.n.b.k.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\RES6D8E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Thu Jul 25 15:15:49 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.983534927270386
Encrypted:	false
SSDEEP:	24:H/m9pKLXdH4wKTFexmfwI+ycuZhNwakSMPNnqSSd:qWNnKTAxmo1ulwa3cqSC
MD5:	1B4C1A05AD3653789DDDBB87A9FE60ED
SHA1:	57837FF4CB3E01B93151D1680FB680A6DF9623BF
SHA-256:	43E002DE0CDF74738443C7063FE519F811A1F506307CFFFA3C52CB43A442AD86
SHA-512:	6A4ACC8EAEEF69C6530D6752641E55F353C06F6BE3F41F0EC8E6444FC98E6EA7118C9E2C4A0CA3CEBAE5BF747ECC803BF47CA4AE44D2902517C4B8C2AFC389AC
Malicious:	false
Preview:	L...%l.f.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP......................mm..r...]..s..........5.......C:\Users\user\AppData\Local\Temp\RES6D8E.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.k.j.w.n.q.t.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\SuWar3Tools\SuLibrary\SuLibrary.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	3.8030984168652506
Encrypted:	false
SSDEEP:	384:uO8nAdw84FUinQv/LgaXDpqszUV8WMeCdIl6aLxGbVMxPbpPtJ80V/z:kBED3VqLV8WMeCdIIoGbCRbpPt60d
MD5:	B3B4A16A4B27992C9C2D06B90AF2B105
SHA1:	BEB470436730DF74B6896D01F2D2C352C07781EE
SHA-256:	10A1C520C53218E463B1083362C5FD13D333E01F2BB3CEB89FCF86CEBF748D10
SHA-512:	AC8767DDF18733A7AFAD06101DD43201C2002F8D9B73BFB70C16418AEBEAE95213EAFE6FC78BF277F63E2DC31C246998D9FC4931B375DE38AB06855D8A4D9E78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&............!..0.................. ........... ....................... ............`.....................................O.......x...............................8............................................ ............... ..H............text....... ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H........,..............................................................0...........s....%r...po....%r...po....%r1..po....%rQ..po....%r...po....%r...po....%r...po....}.....s....%r...po....%r...po....%r?..po....%ru..po....%r...po....%r...po....%r...po....%r...po....%r...po....%r3..po....%rK..po....%ry..po....}.....(....*...0..........s.......}.....s....}.....{...........s....o.....,.........s....(.....{.....o.....{.....o....r...p(.....{..........%...o......o....o....,?r...p.o

C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\638574967303861233.zip

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	207752
Entropy (8bit):	7.992296384111276
Encrypted:	true
SSDEEP:	3072:liryvj9WgvyN9oTSVLGkTuCAC3kRcZGedaE58nNoLYdyPvYIRW3c5S7C+XxJFk:lir4kom9KcGaaESnBwpRicqXHW
MD5:	0012207051B30683A5F1FCEDE4F62276
SHA1:	3047C3E7E2D41C2EFE66A74B316B2A9988B2647B
SHA-256:	3C3C5D3B7CD7B62FF7AD6E8994AC76C19A78D5A349E60547C69615FF98EF9896
SHA-512:	1C53ECA3FB811D3919B022C599453E21CFA8BF022E7D10F43D3C08529EA65224A326F519C4FBC5A8D378F0579C4BA799307971E1B57DE3ADF10E277FE946F9AD
Malicious:	false
Preview:	PK........&..X...T....X.......Microsoft.Web.WebView2.Core.dll.].\|.....i@..=..%.^...I. HY....D...;""".....DP.Q@DE...T..A......+......vgg.......^......(.....e.B.k....S."...([../..............2:.!c..iw.M..?&m..........Z-.......RQ....W...q.J...[.E..Q..-..(9N#..<pZ..U......Y...Z-..5x&T...O...K"......].0.....>..K>..(e..N...~...C........K>GMbvM.z.A........n`;.:.#.kJ...3t.N...3bM..w...w=J.n..$.J..]J._......e3....e(Jt.m.S.....J..v.sr....g.+.~hY.OV..R>6'...f.....6E..C.:...&.....Dt.';.%..3...w/..j..o-. w.&...S9;&'.F...q......x.^....M....r.#U...P).19....Ht.u.J.;.u.d.D=P......3Q.`#..2T)?KIK@....JZ"9V.C.;.....5T.5........o..#AQ..O{...t.}........ZM#..L..h'<;.6...K....]v.S?.....D..{cs..{\......`klN1.2.M..'.M....S.P..q.R.l......TQ&....hUK'R].1..q...n.'@..^..O2.7B..>H>.i..+I.... .:..;Xy;..z.....GI,.....$2..E.q....kg...........!......;2V.u..u..uJ.....p.-&.:C.:..$.....p...p]!q]Aq.....f..K..........0.o.........Q....p[U.p.B.F...p...h..1].......7F...pc..#S.

C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	567896
Entropy (8bit):	5.446791956614718
Encrypted:	false
SSDEEP:	12288:OPXmgCI7JrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIgcvm:O7f
MD5:	E77CD7924E692B88AD687E1366142DAF
SHA1:	DE150A7FCDF074C98129434A57C87FD7A9390609
SHA-256:	616157863B1CD1F1330B4914DD013ADEF10A4CE8CD819598FD6BD4037C2C1646
SHA-512:	4110680050E6463E7DC6EE8ED053E814C03DE29A7936916FD1DBEE96C73A3336FBB8A39663F7126C1F70D34ACFB8766C4FC3015D9E5798EF611A54CBBADD5F21
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N.f.........." ..0..z..........f.... ........... ....................................`.....................................O.......................X(.......................................................... ............... ..H............text...ly... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B................H.......H...........\...................\.........................................(...:.(.....}......0..........~+.....~+...(,...,.r...pr...ps-...z.....(....o/.........(0.....-..~+...(,...,.r_..p..d...(1...s2...z..(3...t....%-.r...ps2...zs6.....U....o4... .@..3.r...p..s5...z..z....o4... ....3.r...p..s5...z..z.~+...(6...,..(7...&......(....e.!.. ......e.!.. .................0..G.........(8...}.......}.......}.......}.......}......\|......(...+..\|....(:.....0..I........(2......o..

C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38360
Entropy (8bit):	6.284782646274299
Encrypted:	false
SSDEEP:	768:qijOv/1uo4D/iyUdvtYZDgcEST3p4Jjrjh2jJFSUyauTv1JKia5/Zi/WGQK4u6bf:BOvlyUptYZDgcEST3p4JjrjaJFSUyaum
MD5:	4EE8937206E9D8EC553A698B3A7AAA37
SHA1:	D85042111BCD1727EDEDEB53A95DD67CFCA71110
SHA-256:	FF1197C54EC571FD82E1E97A45E1000240C739B0BDC89536DB85A612ECC5FAFD
SHA-512:	E1AC7D7F9194EEF8C57C7204F612F2A184530A01D650BEB4FAE860D06A195BA4E89786BDCE48C00E2132CFC97CBE6D245EBCA33E708C60C6ABB8D864BD9FB7B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0..d..........B.... ........... ....................................`.....................................O....................n...'..............8............................................ ............... ..H............text...Hb... ...d.................. ..`.rsrc................f..............@..@.reloc...............l..............@..B................$.......H........7..xE..........@}..@.............................................(......{....>..}......}......{....>..}......}......{....>..}......}......{...."..}......{....>..}......}......{...."..}.......0..d........{....-K.(....-..(....-..(....-..(....,+..(.....(.....(.....(.......s....(....}.....{....%-.&.(...+.0..C..........(....-..(.......(....,'.o.......(....o......(.......(....o ....*..0..B........#.......?}......}.....(!...}.....("....(a......(#.... . ...(#..

C:\Users\user\AppData\Local\Temp\SuWar3Tools\WebView2\runtimes\win-x86\native\WebView2Loader.dll

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116184
Entropy (8bit):	6.506329478604818
Encrypted:	false
SSDEEP:	3072:mJ7FfqJR70vRq2KVsCKKa/gqeNZ/T+xEtJlAlpB9gr4fm0Z:m7fqJRQY0RKDiEtJeTgr2mI
MD5:	6E91D5628FCAF7A67CD8CCA2C2DE9342
SHA1:	36818E155A3A760306D908E318F6327D635B7453
SHA-256:	DD4C6797FF04625934A14AA7B22D76B847C8B6BB1CCCD7C587EE6FEC6B636121
SHA-512:	DF4E115A718224FCF9DC7315197B4C9135404018F0F6C176D5E826090D1B6F1DC70627C3C3B3834E6E5F721B9A809ECA7D3C51A225F5B0F176AB72CD70E48856
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...K..f.........."!.................>...............................................^....@A.........................u..0...Hv..(........................'......p...4n..8....................k.......................w..<....s..`....................text............................... ..`.rdata..Lu.......v..................@..@.data................x..............@....tls................................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SuWar3Tools\dd3fe5a9-8ec4-44d5-9186-76398ed083f3\dd3fe5a9-8ec4-44d5-9186-76398ed083f3.log

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.195295934496218
Encrypted:	false
SSDEEP:	3:tRzFbsV:PKV
MD5:	4C255D5BA6E86C88D2CA7A9529CC8817
SHA1:	EB9FE1FD4F5D1349B9ED9A729CFE40BC777843A9
SHA-256:	196597B9D8F20D26F607D1CDEBC475CC92492BEAF2ACB897B486D6FC27DA5F2D
SHA-512:	412B893E8A99A4A031DDCD29A89B3CAC96A94A6D641510857C9EA074614A530FFCE2757AF44D77D85546F322C91215CABB6B722C8DD0D3C4E8238190F436395A
Malicious:	false
Preview:	2024-07-25 09:32:10

C:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1106337673962234
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryPYak7Ynqq6NPN5Dlq5J:+RI+ycuZhNtYakS6NPNnqX
MD5:	5CA6C7FADED1398134286C7D313125E0
SHA1:	4AB78C9BF65CA710577110F6FF9A6E9802477E08
SHA-256:	C49CE1E929557DDC0B87CBBEE000308FEBAF143CAC2A83B54C9FE5FFB267F0F6
SHA-512:	481C2426DCBC22DBF2DC0FD6EDF193072882137991D19D3DE5104E1B7B52D391DA883706986B449197BD19F87CE77F3FF9DC1C2E54A1C060F8325D82A644B46D
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.r.v.3.3.q.4.h...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.r.v.3.3.q.4.h...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.0.cs

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	18514
Entropy (8bit):	4.31841024179425
Encrypted:	false
SSDEEP:	192:iuNWs4b6fYymynjFmZP/G3wZ8PK8P5TXXUFaJXV3feaK0K3jh1aK053MLY/t:iuMsYAuNG3OeKelXUgXlfU3m31t
MD5:	3E3AD712B18F4BF1494DD5A39204F477
SHA1:	F2F5362F2393FC6B4B2360B7B5FECD88C002D71E
SHA-256:	52F8717C77C5D5C72366DB9085E22E5A7E2BA702115EBD0FF861913179DB6401
SHA-512:	B873F6ED382BCD2A912736C120E251B271BF5F2948C5AA320FF063A3B4B67114C5C3CC566766C1F5970B40334842BC8B1173DB3DD782A454B36C133293A77D5C
Malicious:	false
Preview:	.using System;.using System.Collections;.using System.Collections.Generic;.using System.IO;.using System.IO.Compression;.using System.Linq;.using System.Net;.using System.Net.Http;.using System.Net.Http.Headers;.using System.Text;.using System.Threading.Tasks;.using System.Web.Script.Serialization;.namespace MyCompiler_NameSpace {.public class MyCompiler_Class {.static MyCompiler_Class().. {.. //...................: .... SSL/TLS ....... System.Net.ServicePointManager.Expect100Continue = true;.. System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12 \| System.Net.SecurityProtocolType.Tls11 \| System.Net.SecurityProtocolType.Tls;.. System.Net.ServicePointManager.ServerCertificateValidationCallback = (sender1, certificate, chain, errors) => true;.. }.public object GetMyObject(Dictionary<string, string> dics).{.var url =

C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (334), with no line terminators
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.118640491549055
Encrypted:	false
SSDEEP:	6:pAu+HIWdyrL/6KewqWVAVMZO/AuA5LXxZ923fMzxszI923fPGA:p3xrL/6KeqAmZO/Au0TxeEw3x
MD5:	1F062D61EAD92BE0684C7A66A70E1A37
SHA1:	5FBA46D092143B8A2DB7DC8C829BF9B7CEB814A4
SHA-256:	2DBD3D8EBC53DDC7DD9367CE486418E7BA9395A9D4AC19537E6C9A683B9B2F54
SHA-512:	E170A67F7AE49BEDC99EFB30297196840436FEFAC24E4B25AFDB12535EAC4ED797F9B66568A70864D7A2B414E69547ECBF5E46C35B22825A2EB42EC34A96BB1B
Malicious:	true
Preview:	./t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.0.cs"

C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.481640677973249
Encrypted:	false
SSDEEP:	384:n3y8ZtEjWHpweuj2HCd+XrYGefz8CIQhZpmG+5c+6gcE42de3:ni8ZtEOmjxdAaz8CjLKs2de3
MD5:	2A4FB8A298693C47A840F420298AF485
SHA1:	3A435748A3902AA6F55ACD5F43760D5D5684B3D9
SHA-256:	89FF7586D74A58EC7E64B6A3649A9CD3F39086FE4B59F26E02A3027932B789E8
SHA-512:	BEBF9D528461FE65AC1E7A7DFB374FA9613B9A7F045CF6DFE74A81718590EC2D0880E19D6C80604BD81ACDB760AF2780E0DD38391D033DFBF2021794B7E6BE24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l.f...........!.....T...........s... ........... ....................................@.................................Ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......@D.../..............................................................(.... ....(....~....-........s.........~....(......0..-.......r...p.s......rW..p...r_..p..(....o.....(...+....0.................(....&....&......................0.................(....&....&.......................(....-..,..o.....2...o....-.rg..p..o....%-.&rg..p....0..X........(....-..(....,.rg..p.ri..po....,.s.....(...+....(....s.....(...+.o....t........(.....0...........,..o.....2..(....,.

C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.out

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (415), with CRLF, CR line terminators
Category:	modified
Size (bytes):	836
Entropy (8bit):	5.263066711575368
Encrypted:	false
SSDEEP:	24:KMoqddj6KeSZO/A3e1kKax5DqBVKVrdFAMBJTH:dosj6dSZmA3e1kK2DcVKdBJj
MD5:	F68B79F22A6BED24396FF2BD87F96036
SHA1:	94296E2AE294BB8F051E25BF5A77434A69E1A34A
SHA-256:	FA94CEA6C9F8DA7C955086BB6F8A2BB24174E86A75E15F73B6852544C6EEDE46
SHA-512:	492D004D8A71599D905B51B322AFE27794D09FA75A0BFAC240313A6986FCFCDF1234B3BA42D0ADFBC8C3D374E3C93D6965589403B74058BA6CC1DC9C428E2298
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1126963070808107
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry65Gak7Ynqqv5XPN5Dlq5J:+RI+ycuZhN85GakSv5XPNnqX
MD5:	C0AB1D8AB9A0E8E44EB457CB8FF77B9F
SHA1:	371F784323BDB1731771D819733B7F413A40DCED
SHA-256:	6672A3C2D8C8FCB1AD85A1B5C0AD114217CFE9C2FB2BC5921974423A6407F0FF
SHA-512:	25C5E135DCA9B7251AA650AD6E7D9F62E1840DB2D5AB36C150C07BE8BFC0A5E3183764CC3559757DB0C2BFF80E934C395A1D24CE70DE0324A827F8111B430A9C
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.k.e.q.n.b.k.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...z.k.e.q.n.b.k.w...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.0.cs

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	20000
Entropy (8bit):	4.34859160135715
Encrypted:	false
SSDEEP:	384:iuMsYrD2HpZFDmuNG3OeKelXUgXlfU3m31t:TRblkLO23
MD5:	06545AA8130572FA3E733763D161EEBF
SHA1:	3DDCDCCB81954F65DBE2C7A93BCB7D75B6DFA347
SHA-256:	B9EB405734C0B709405B1099804ED9EF942C40FB31C33A6A826F42C277A4D0AC
SHA-512:	1C61FD07449505B8182516A7F142B557B598BBC8A26A25174259CD10505BD431469DDE492A520D3593C1A44730C9238DC0D665C4D8BEC96F50BDC79799FBA65B
Malicious:	false
Preview:	.using System;.using System.Collections;.using System.Collections.Generic;.using System.IO;.using System.IO.Compression;.using System.Linq;.using System.Net;.using System.Net.Http;.using System.Net.Http.Headers;.using System.Text;.using System.Threading.Tasks;.using System.Web.Script.Serialization;.namespace MyCompiler_NameSpace {.public class MyCompiler_Class {.static MyCompiler_Class().. {.. //...................: .... SSL/TLS ....... System.Net.ServicePointManager.Expect100Continue = true;.. System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12 \| System.Net.SecurityProtocolType.Tls11 \| System.Net.SecurityProtocolType.Tls;.. System.Net.ServicePointManager.ServerCertificateValidationCallback = (sender1, certificate, chain, errors) => true;.. }.public object GetMyObject(Dictionary<string, string> dics).{.var r = ne

C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (334), with no line terminators
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.104595952886211
Encrypted:	false
SSDEEP:	6:pAu+HIWdyrL/6KewqWVAVMZO/AuA5LXxZ923fLEMiMHUzxszI923fLEMiSn:p3xrL/6KeqAmZO/Au0TxezEMiMHUwzE6
MD5:	2786C7A38D0FA45A531E48156543AAB4
SHA1:	6D5187AAE4C45133F8BA478339154758E6CD2D32
SHA-256:	DBB35390027F43BEF8E89FE390A2316245E5D74AE6E8D9CF06D3750723BD5145
SHA-512:	44D0E25E9FC882E325955C1D34C70926581FB1B0E70B23480CE40F540BE45CD478F84456C8911E08C5AE3CF47E1629D2C38E9B24E4E826B83E54E2346885FAA5
Malicious:	false
Preview:	./t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.0.cs"

C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.453535937282741
Encrypted:	false
SSDEEP:	384:0XXkC5rnl4EI9Wqu+zwyylQO0xDOvzbQTQvUzHphZpyG+Mcf5yMIACchD:0nrrnlm9W3dlQO0JO/RsHpLilIACchD
MD5:	36C841799FE7E5AB6588C5F42B6723B6
SHA1:	843530F2B87518FBDFEF7FAB15D51EA4FFE4B9BE
SHA-256:	7846DD6CFA3071158E20F27B050A2CE0175B8FFA0D6CEE2A3B4280E69898B2A3
SHA-512:	2BAA35CA3E610ECD2590E2645105FF73E3346AE3A15F5776DAC541ACF64DDC9C3FCE4584DFFE161F27EDA28309A1F232DCB58755C0790448E8DD6BD43066A906
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."l.f...........!.....Z...........x... ........... ....................................@.................................Xx..S.................................................................................... ............... ..H............text....X... ...Z.................. ..`.rsrc................\..............@..@.reloc...............`..............@..B.................x......H........F..d1..............................................................(.... ....(....~....-........s.........~....(......(....6..{....(....6..{....(....*..0..n.......s......(......o......81.....(..................r...p....r...p........8...........s.......9.......(....(...+..(................^...o............(....}.......i.1=....(....-2................\|...o....(...+.... ...s....o....-D...i.1?....(....-4................\|...o....(...+....!...s....o....-......X.......i?

C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.out

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (415), with CRLF, CR line terminators
Category:	modified
Size (bytes):	836
Entropy (8bit):	5.27788302504193
Encrypted:	false
SSDEEP:	24:KMoqddj6KeSZO/A3etFXuKax5DqBVKVrdFAMBJTH:dosj6dSZmA3etFeK2DcVKdBJj
MD5:	219E5DEC7F42F336914240F08A083F38
SHA1:	58A8686CB0B0D51AEAAB5F70382DBFE94664D9D4
SHA-256:	A0A675A888ACB6ACD23CDE275394050B86303131BEBE47C57822E5DEC8B9C64E
SHA-512:	B91F177DFA01BD1060C0B876273DA1DC3812D85CDB2B8F2DA37D52B0CC7993F04BEFDBB05766EE7A6F1FF955DFA9F1F830E589A7DE2BB913F079568C57185BC5
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"mscorlib.dll" /R:"System.dll" /R:"System.Core.dll" /R:"System.IO.Compression.dll" /R:"Microsoft.CSharp.dll" /R:"System.Net.Http.dll" /R:"System.Web.Extensions.dll" /out:"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5283840
Entropy (8bit):	7.6601712942780855
Encrypted:	false
SSDEEP:	98304:5E8ldVZpn+8vcAAdjj0X9sDuw3F5uNRYZ5oHznKML2ef9ND:LlDrc3X0X9sD1CYTHML2ef
MD5:	F72D84B6D1683DEE10A997DEDB825D7D
SHA1:	93D52D4B81F9ABF93FDF7749D1FF90B5BC8D1F6D
SHA-256:	6A31655B2CF2478A81B19A10877A3E08973D281F7E820097FE358364A643B818
SHA-512:	B281447E136758CEEC0953C33F8A29C561B5F170B7359688372C607D506E32C38F97C9A0FA696864CAE6C23B673B45AA2136A20CD3282D7AA15ABA5860D32CB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.,f..........#.........../.............. ....@...........................P.....G Q..............................................pP.hS..........................................................H...@............ ..@............................text...@........................... ..`.rdata....... ....... ..............@..@.data....}.......P..................@....GS.....`....0...................... ..`.pdata..IF... 6..P....5.............@..@.rsrc...hS...pP..`...@P.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5283840
Entropy (8bit):	7.6601712942780855
Encrypted:	false
SSDEEP:	98304:5E8ldVZpn+8vcAAdjj0X9sDuw3F5uNRYZ5oHznKML2ef9ND:LlDrc3X0X9sD1CYTHML2ef
MD5:	F72D84B6D1683DEE10A997DEDB825D7D
SHA1:	93D52D4B81F9ABF93FDF7749D1FF90B5BC8D1F6D
SHA-256:	6A31655B2CF2478A81B19A10877A3E08973D281F7E820097FE358364A643B818
SHA-512:	B281447E136758CEEC0953C33F8A29C561B5F170B7359688372C607D506E32C38F97C9A0FA696864CAE6C23B673B45AA2136A20CD3282D7AA15ABA5860D32CB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.,f..........#.........../.............. ....@...........................P.....G Q..............................................pP.hS..........................................................H...@............ ..@............................text...@........................... ..`.rdata....... ....... ..............@..@.data....}.......P..................@....GS.....`....0...................... ..`.pdata..IF... 6..P....5.............@..@.rsrc...hS...pP..`...@P.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe.zip (copy)

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5283840
Entropy (8bit):	7.6601712942780855
Encrypted:	false
SSDEEP:	98304:5E8ldVZpn+8vcAAdjj0X9sDuw3F5uNRYZ5oHznKML2ef9ND:LlDrc3X0X9sD1CYTHML2ef
MD5:	F72D84B6D1683DEE10A997DEDB825D7D
SHA1:	93D52D4B81F9ABF93FDF7749D1FF90B5BC8D1F6D
SHA-256:	6A31655B2CF2478A81B19A10877A3E08973D281F7E820097FE358364A643B818
SHA-512:	B281447E136758CEEC0953C33F8A29C561B5F170B7359688372C607D506E32C38F97C9A0FA696864CAE6C23B673B45AA2136A20CD3282D7AA15ABA5860D32CB3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.,f..........#.........../.............. ....@...........................P.....G Q..............................................pP.hS..........................................................H...@............ ..@............................text...@........................... ..`.rdata....... ....... ..............@..@.data....}.......P..................@....GS.....`....0...................... ..`.pdata..IF... 6..P....5.............@..@.rsrc...hS...pP..`...@P.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\SuWar3Tools.cfg

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17505
Entropy (8bit):	5.548454194962492
Encrypted:	false
SSDEEP:	192:WvHqGHZvkGHZPxGHZJfGHZl8GHZrdGHZA8GHZDQtGHZD/JGHZDpGHZwSGHZyeGH0:lGQEZJF/YnFXuZeCB78p5Ou
MD5:	33FE65C9DC812106694887A573FE26CE
SHA1:	9EC92432478DB2AF17D5D1CB9D386D0CEAB98FDD
SHA-256:	A7C60727A7CF2D8B32224DE2FBCF79246C124F8FBBDDCDDF1DB19EEB2FF542AD
SHA-512:	26D8BD699B83786F3E58F45EC58D47D418C861795C59F1B9B94CA1FD80CF451791E7342D61612BFBD1E84078F625712E62FFF1740EECF80F8C0494C324EEE6EF
Malicious:	false
Preview:	{"ReName":false,"HideTray":false,"ExtSuffix":null,"ExtLocalVer":null,"ExtPlugins":null,"ExtRunHis":null,"StartQuickly":null,"RecordPlay":false,"ChatJudgeEnter":false,"ForceRemap":false,"F1MutiID":false,"FormKeys":[57,48],"ChatPoint":null,"CusName":"7EA10491","MixList":"War=Wra;WC3=W3C","Version":"2.1.1.155","War3Caption":null,"War3Class":null,"War3Process":null,"War3Dll":null,"War3Split":",","War3Port":0,"Language":0,"KeySendType":0,"EatOriginalKey":true,"ChatJudgeByTimer":false,"PlayFloorAdd":1,"KeysInterval":0,"DbPressInterval":500,"WaitSTime":0,"WaitMTime":0,"WaitSInterval":0,"ExtKillTime":0,"PosTime":0,"PosMLen":0,"PosHasHM":true,"PosLeft":0,"PosBottom":340,"PosFloor":null,"PosExtUnits":null,"PosExtUnitTime":0,"ShutcutLeft":20,"ShutcutTop":20,"KeyState":{"KeyPress":145,"IgnoreShiftPress":false,"OriKeyType":0,"CtrlOn":false,"AltOn":false,"ShiftOn":false,"RestoreFunKey":false,"KeyTrigger":145,"Pos":0,"KeyType":0,"MouseType":0,"PosX":0,"PosY":0,"KBType":0,"KeyAct":0,"LeftClick":false,

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.60598685567043
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.72% Win32 Executable (generic) a (10002005/4) 49.67% Windows ActiveX control (116523/4) 0.58% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	LisectAVT_2403002B_286.exe
File size:	4'861'966 bytes
MD5:	feffd73ddba802eae61e964e78ef7e95
SHA1:	e727e9d97f34c4e0903f4c9188883347addae2e8
SHA256:	31fc993f42d691c16489d7e3e101f64362c585dd29cf40aad479dd2f53103b4c
SHA512:	c26703b59983e389e6f2c1d350d678b3e43ec26b3995089b1d972087171a73e056d068b245b519faaaf01a59123d68ddf970a2328ca326101d414d5d8e76dcb5
SSDEEP:	98304:KvbHGZpn+8vcAAGY36Vr/clxf59+XxRxy5tIAq+6l2oKxcD:KvbGrcblxf59eRxyPXq+6Y9x
TLSH:	6226F1433BF640B9D68B68B129779B1BABB1AE16871144C3E7D13D8ABA313C37535342
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e..........#..........p).............. ....@..........................`J......cJ....................................

File Icon


Icon Hash:	e079515959592bd4

Static PE Info

General

Entrypoint:	0x43d9d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6587D2E7 [Sun Dec 24 06:42:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2abab44f29387a768ac32ec5f31bee3f

Entrypoint Preview

Instruction
call 00007FEFF91E4BFDh
jmp 00007FEFF91DC4ECh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FEFF91DC6F6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FEFF91DC720h
test ecx, 00000003h
jne 00007FEFF91DC6C1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FEFF91DC6BAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FEFF91DC704h
test ah, ah
je 00007FEFF91DC6F6h
test eax, 00FF0000h
je 00007FEFF91DC6E5h
test eax, FF000000h
je 00007FEFF91DC6D4h
jmp 00007FEFF91DC69Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00452628h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
test eax, eax
pop edi
mov dword ptr [ebp-04h], eax
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x69310	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a0000	0x5358	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5f448	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x52000	0x440	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x50a20	0x51000	6c637bc1b91b409e63672a1642e34beb	False	0.5338541666666666	data	6.7603183934008575	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x52000	0x1898e	0x19000	0e0210d0c2b63a83f5c634de4ca7837c	False	0.323251953125	data	5.198624352697313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6b000	0x137e58	0x135000	24dba55eb86ec60b062159e5918216c0	False	0.4440807354874595	data	6.6308106841929915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.m!S	0x1a3000	0x1b9ac0	0x1ba000	e9362fb58fbb8a724b1596a429aef1ae	False	0.9398359065681561	data	7.6941834302880014	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.pdata	0x35d000	0x142bc3	0x143000	a3393b8446af372453c73d1ef05728f3	False	0.8926937705592105	data	7.986598759119632	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4a0000	0x5358	0x6000	1ee0675dff7e66704bcc19df22ef2532	False	0.545654296875	data	5.63281738429814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4a0130	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.6608998582900331
RT_GROUP_ICON	0x4a4358	0x14	data	1.1
RT_VERSION	0x4a436c	0x304	data	0.4261658031088083
RT_MANIFEST	0x4a4670	0xce8	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.4621670702179177

Imports

DLL	Import
KERNEL32.dll	FreeLibrary, Sleep, GetTickCount, InterlockedIncrement, InterlockedDecrement, SetLastError, HeapFree, GetProcessHeap, HeapReAlloc, HeapAlloc, InitializeCriticalSection, DeleteCriticalSection, FindResourceExA, GetUserDefaultUILanguage, GetCurrentProcessId, CompareStringW, CloseHandle, SetEvent, GetLastError, CompareStringA, WaitForSingleObject, lstrcpyW, GetSystemTimeAsFileTime, FindFirstFileW, FindClose, WriteFile, lstrcatW, SetFileTime, FormatMessageA, GetModuleFileNameW, CreateFileA, ReadFile, IsBadReadPtr, SetFilePointer, CreateEventA, GetModuleFileNameA, GetCurrentProcess, GetWindowsDirectoryA, GetVolumeInformationA, FlushInstructionCache, WriteConsoleW, SetEnvironmentVariableW, WriteConsoleA, FlushFileBuffers, SetStdHandle, GetStringTypeW, GetStringTypeA, QueryPerformanceCounter, GetCommandLineW, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetConsoleMode, GetConsoleCP, GetStartupInfoA, GetFileType, SetHandleCount, LCMapStringW, LCMapStringA, IsValidCodePage, GetOEMCP, GetCPInfo, GetTimeZoneInformation, GetCurrentThreadId, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetStdHandle, HeapCreate, VirtualFree, RtlUnwind, GetStartupInfoW, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, CreateThread, ResumeThread, ExitThread, GetSystemInfo, VirtualAlloc, GetThreadLocale, GetLocaleInfoA, GetACP, HeapSize, HeapDestroy, GetVersionExA, RaiseException, WideCharToMultiByte, lstrlenW, lstrcmpiW, SetEnvironmentVariableA, IsBadWritePtr, VirtualProtect, VirtualQuery, lstrcmpiA, MultiByteToWideChar, GlobalAlloc, ExitProcess, lstrcmpA, LoadLibraryA, GetProcAddress, LockResource, LoadResource, SizeofResource, FindResourceA, lstrcpyA, lstrlenA, GetModuleHandleA, InterlockedExchange, GlobalFree, GlobalUnlock, LeaveCriticalSection, GlobalLock, EnterCriticalSection, GetConsoleOutputCP
USER32.dll	UnregisterClassA, ReleaseDC, GetWindowTextA, GetWindowRect, SetCursor, GetWindowLongA, LoadCursorA, GetSystemMetrics, SetWindowLongA, GetParent, GetCursorPos, GetDesktopWindow, MapWindowPoints, SetWindowPos, SendMessageA, SetForegroundWindow, ReleaseCapture, PostMessageA, BeginPaint, GetMessageA, TranslateMessage, DrawIcon, DispatchMessageA, LoadIconA, CreateDialogIndirectParamA, SetTimer, EndPaint, LoadStringA, SetClassLongA, KillTimer, DestroyWindow, EndDialog, PtInRect, GetDC, DrawEdge, InvalidateRect, GetClassNameA, PostQuitMessage, OffsetRect, TrackMouseEvent, LoadImageA, ScreenToClient, SetActiveWindow, GetWindowTextLengthA, IsDialogMessageA, SetWindowTextA, EnableWindow, GetActiveWindow, UpdateWindow, AdjustWindowRectEx, CallWindowProcA, CreateWindowExA, RegisterClassExA, DefWindowProcA, ShowWindow, SetFocus, TranslateAcceleratorA, DrawFocusRect, DrawTextA, SetCapture, MessageBoxA, wsprintfA, GetClientRect, FillRect
GDI32.dll	DeleteObject, CreateDIBSection, CreateSolidBrush, LineTo, MoveToEx, CreatePen, CreateCompatibleBitmap, CreateFontIndirectA, CreateCompatibleDC, DeleteDC, TextOutA, GetObjectA, SetBkMode, GetStockObject, StretchBlt, SetDIBColorTable, GetDIBColorTable, SelectObject, BitBlt, GetTextExtentPointA, SetTextColor
ADVAPI32.dll	RegQueryValueExA, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, RegSetValueExA
ole32.dll	CoSetProxyBlanket, CoInitializeEx, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, GetErrorInfo, SafeArrayPutElement, SysAllocStringLen, VariantChangeType, VariantTimeToSystemTime, SystemTimeToVariantTime, SafeArrayDestroy, SysAllocString, SysFreeString, SysStringLen, SafeArrayCreateVector, SafeArrayAccessData, SafeArrayUnaccessData, VariantInit, VariantClear
SHLWAPI.dll	StrRChrW
gdiplus.dll	GdipDeleteGraphics, GdipGetImagePaletteSize, GdipGetImageGraphicsContext, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipGetImagePalette, GdipBitmapLockBits, GdipDisposeImage, GdipDrawImageI, GdipFree, GdiplusShutdown, GdiplusStartup, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipBitmapUnlockBits, GdipAlloc
MSIMG32.dll	TransparentBlt, AlphaBlend
iphlpapi.dll	GetAdaptersInfo
VERSION.dll	GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T15:16:59.746186+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49732	40.127.169.103	192.168.2.5
2024-07-25T15:17:25.307313+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49749	142.250.185.194	192.168.2.5
2024-07-25T15:17:38.371108+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49758	40.127.169.103	192.168.2.5
2024-07-25T15:17:25.507948+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49749	142.250.185.194	192.168.2.5
2024-07-25T15:18:52.480080+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49815	142.250.176.194	192.168.2.5
2024-07-25T15:18:52.299166+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49818	142.250.65.238	192.168.2.5
2024-07-25T15:18:39.999941+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49800	142.250.80.66	192.168.2.5
2024-07-25T15:17:25.300914+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49749	142.250.185.194	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 15:17:05.215158939 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:05.215200901 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:05.215333939 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:05.215610027 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:05.215616941 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:05.215683937 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:05.218965054 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:05.219010115 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:05.219060898 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:05.219574928 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:05.219590902 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:05.219636917 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:05.365937948 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:05.365959883 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:05.366344929 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:05.366383076 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:05.366406918 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:05.366419077 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:05.380280972 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:05.380316019 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:06.329384089 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:06.329591990 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:06.332055092 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:06.332062006 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:06.332735062 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:06.345149040 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:06.345225096 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:06.347033978 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:06.347048044 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:06.347347021 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:06.370770931 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:06.370874882 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:06.373707056 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:06.373716116 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:06.373999119 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:06.385514021 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:06.400943995 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:06.416529894 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:06.456425905 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:06.456511974 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:06.459172964 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:06.459183931 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:06.459434986 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:06.510294914 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.255166054 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.255449057 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:07.255525112 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:07.256499052 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.296508074 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:07.296529055 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.300491095 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:07.300506115 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.375649929 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:07.375752926 CEST	443	49739	185.199.108.153	192.168.2.5
Jul 25, 2024 15:17:07.375838041 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:07.425091982 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.425120115 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.425259113 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.425272942 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.425431013 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.427161932 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.427237988 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.432524920 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.432693958 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.486787081 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.486974001 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.759963036 CEST	49739	443	192.168.2.5	185.199.108.153
Jul 25, 2024 15:17:07.917345047 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.917432070 CEST	443	49736	216.105.38.12	192.168.2.5
Jul 25, 2024 15:17:07.917557955 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.917557955 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.917892933 CEST	49736	443	192.168.2.5	216.105.38.12
Jul 25, 2024 15:17:07.924195051 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:07.926273108 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:07.926341057 CEST	443	49737	140.82.121.4	192.168.2.5
Jul 25, 2024 15:17:07.926342964 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:07.926392078 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:07.926836967 CEST	49737	443	192.168.2.5	140.82.121.4
Jul 25, 2024 15:17:07.937473059 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:07.937516928 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:07.937693119 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:07.937881947 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:07.937896013 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:07.975794077 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.975825071 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.975861073 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.975950956 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.975950956 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.975975037 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.985619068 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.985682964 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.985690117 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.988080978 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:07.988334894 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:07.988342047 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:08.002926111 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:08.003124952 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:08.003132105 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:08.003323078 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:08.111207008 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:08.111576080 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:08.111810923 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:08.111850023 CEST	443	49738	13.107.42.20	192.168.2.5
Jul 25, 2024 15:17:08.111932039 CEST	49738	443	192.168.2.5	13.107.42.20
Jul 25, 2024 15:17:08.277690887 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.277725935 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:08.277790070 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.278120995 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.278136015 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:08.506684065 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.506759882 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.508409977 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.508433104 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.508687019 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.509954929 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.556500912 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.721781969 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.722785950 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.722852945 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.722872972 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.725058079 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.725092888 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.725117922 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.725126982 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.725167036 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.730114937 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.731268883 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.731298923 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.731326103 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.731334925 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.731379032 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.732583046 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.738404036 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.738457918 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.738466024 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.791630983 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.812102079 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:08.812418938 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.814393997 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.814647913 CEST	443	49740	185.199.110.133	192.168.2.5
Jul 25, 2024 15:17:08.814704895 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.821547985 CEST	49740	443	192.168.2.5	185.199.110.133
Jul 25, 2024 15:17:08.824374914 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.824394941 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:08.824775934 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:08.826227903 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:08.872498989 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.179378033 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.179663897 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.179747105 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.179778099 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.179816008 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.181236029 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.184711933 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.184883118 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.184894085 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.187175989 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.187244892 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.187252998 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.187306881 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.287839890 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.288021088 CEST	443	49741	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:09.288028955 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.288275957 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:09.288820982 CEST	49741	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.334062099 CEST	49742	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.334120989 CEST	443	49742	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.334199905 CEST	49742	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.334821939 CEST	49742	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.334846020 CEST	443	49742	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.423273087 CEST	49742	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.450491905 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.450545073 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.450695038 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.451169968 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.451195955 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.976269960 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.976421118 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.990787029 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:16.990817070 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.991170883 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:16.991281986 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:17.056713104 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:17.104501963 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:17.194612980 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:17.194911957 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:17.194983006 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:17.195034981 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:17.195110083 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:17.299690008 CEST	49743	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:17.299731016 CEST	443	49743	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:22.370718956 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:22.370790958 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:22.370862007 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:22.371284962 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:22.371303082 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:22.933587074 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:22.933660984 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:22.934135914 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:22.934148073 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:24.124023914 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:24.124099970 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:24.124110937 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:24.124176025 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:24.220185041 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.220232010 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:24.220381021 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.233963966 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.233999014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:24.943758965 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:24.943861008 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.945938110 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.945949078 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:24.946198940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:24.948127985 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:24.988507032 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.670627117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.713390112 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.713401079 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.760266066 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.769095898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769105911 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769121885 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769134045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769140005 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769247055 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.769247055 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.769257069 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769268990 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.769309044 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.798101902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.798114061 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.798142910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.798183918 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.798199892 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.798280954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.851397038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.869129896 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.869143963 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.869179964 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.869194984 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.869214058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.869242907 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.869286060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.869286060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.888569117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.888597965 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.888725042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.888725042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.888742924 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.888928890 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.898818016 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.898866892 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.898931026 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.898940086 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.898983955 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.898984909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.911279917 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.911324978 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.911408901 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.911408901 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:25.911420107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:25.911503077 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.184091091 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.184148073 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.184210062 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.184226036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.184391022 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.185379028 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.199672937 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.199767113 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.222896099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.223161936 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.276582956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.276609898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.276851892 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.276871920 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.276922941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.289354086 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.289355040 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.289391994 CEST	443	49746	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:26.289462090 CEST	49746	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.290020943 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.290045977 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:26.290102959 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.290329933 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:26.290342093 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:26.319489002 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.319515944 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.319665909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.319683075 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.319853067 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.335944891 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.336133957 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.367633104 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.367660046 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.368431091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.368463993 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.368568897 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.391047001 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.391074896 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.392904997 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.392924070 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.393830061 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.413317919 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.413348913 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.413477898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.413489103 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.413595915 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.423887968 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.423939943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.423990011 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.423990011 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.424002886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.425050020 CEST	49753	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.425096989 CEST	443	49753	172.217.16.194	192.168.2.5
Jul 25, 2024 15:17:26.425173044 CEST	49753	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.426013947 CEST	49753	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.426028013 CEST	443	49753	172.217.16.194	192.168.2.5
Jul 25, 2024 15:17:26.426378012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.426449060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.426456928 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.426490068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.439920902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.439949036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.440045118 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.440073967 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.440097094 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.440300941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.450072050 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.450098038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.450330973 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.450354099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.451548100 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.459939957 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.459958076 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.460073948 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.460098028 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.460167885 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.469290018 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.469335079 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.469434023 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.469434023 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.469463110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.469644070 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.492659092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.492688894 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.492796898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.492796898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.492834091 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.492897034 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.493813992 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.505378008 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.505410910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.505512953 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.505530119 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.505556107 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.505575895 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.512414932 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.519654989 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.519680023 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.519781113 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.519782066 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.519793987 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.519887924 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.523219109 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.523303032 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.523310900 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.524736881 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.524786949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.524794102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.524859905 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.528001070 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.528064013 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.529848099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.530072927 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.534636974 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.534717083 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.539383888 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.539442062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.539495945 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.539525986 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.539562941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.539562941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.542097092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.542570114 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.543591976 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.543663025 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.544555902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.544806004 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.547995090 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.548054934 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.548116922 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.548116922 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.548130035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.548299074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.551836014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.551888943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.552037954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.552050114 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.552103996 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.556076050 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.556165934 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.561616898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.561638117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.561722994 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.561744928 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.561779976 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.565504074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.567296028 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.567312956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.567447901 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.567459106 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.567591906 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.569288015 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.569582939 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.571779966 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.571810961 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.571866035 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.571872950 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.571912050 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.571939945 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.573333979 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.573461056 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.576908112 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.576972961 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.577020884 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.577020884 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.577033043 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.578119993 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.578207970 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.578237057 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.580775976 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.580820084 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.580856085 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.580868006 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.580882072 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.580961943 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.582854033 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.582989931 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.584801912 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.584933996 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.584948063 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.589158058 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.589174986 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.589262962 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.589262962 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.589282990 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.592442989 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.592459917 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.592518091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.592536926 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.592549086 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.592581987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.595679045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.595714092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.595792055 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.595792055 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.595814943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.595881939 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.599322081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.599339008 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.599431038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.599431038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.599452972 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.599503040 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.604022980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.604039907 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.604209900 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.604227066 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.604299068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.604299068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.607747078 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.607762098 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.607857943 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.607877970 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.607923031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.610704899 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.610723972 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.610811949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.610811949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.610827923 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.610972881 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.613858938 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.613876104 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.613956928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.613956928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.613965988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.614445925 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.616350889 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.616364956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.616522074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.616544962 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.616590023 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.619091988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.619111061 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.619505882 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.619514942 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.619714975 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.623229980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.623249054 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.623301983 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.623308897 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.623388052 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.626300097 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.626317978 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.626471043 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.626481056 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.626599073 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.626797915 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.626797915 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.629190922 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.629209042 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.629297018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.629297018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.629304886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.629700899 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.633558989 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.633593082 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.633692026 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.633692026 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.633722067 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.634008884 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.636006117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.636037111 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.636112928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.636112928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.636122942 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.636245012 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.639604092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.639632940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.639683962 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.639708996 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.639741898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.639741898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.647309065 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.651107073 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.651133060 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.651186943 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.651196003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.651257038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.651257038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.653728962 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.653759003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.653829098 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.653829098 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.653836012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.654104948 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.655989885 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.656007051 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.656050920 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.656056881 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.656094074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.656121969 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.658447027 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.658464909 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.658540010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.658540010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.658545971 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.658724070 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.659390926 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.660367966 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.660382986 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.660478115 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.660478115 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.660491943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.660608053 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.662385941 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.662403107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.662838936 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.662846088 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.663573027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.664271116 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.664288044 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.664335012 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.664346933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.664563894 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.666640997 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.666661024 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.666721106 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.666733980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.667361021 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.669661045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.669677973 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.669749975 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.669749975 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.669755936 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.671051979 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.672359943 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.673463106 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.673480988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.673559904 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.673566103 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.673599958 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.673599958 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.675959110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.675977945 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.676033974 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.676047087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.676081896 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.676081896 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.679418087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.679440022 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.679485083 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.679501057 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.679543018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.679543018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.679948092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.679948092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.682183027 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.682202101 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.682286978 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.682286978 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.682296038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.683449030 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.684238911 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.685184002 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.685204029 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.685282946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.685282946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.685290098 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.687452078 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.688886881 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.688905001 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.688982010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.688982964 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.688990116 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.691020012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.691077948 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.691101074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.691101074 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.691108942 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.691648960 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.691648960 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.692753077 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.692786932 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.693459034 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.693466902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.693830967 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.694212914 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.694561005 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.696706057 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.696727037 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.696777105 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.696784019 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.696842909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.699728012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.699753046 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.699853897 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.699862003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.701982975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.702029943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.702044010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.702054024 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.702133894 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.702133894 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.704715967 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.704771042 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.704828978 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.704828978 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.704837084 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.704875946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.704948902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.705111027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.707299948 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.707319975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.707365036 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.707374096 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.707410097 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.707410097 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.735013008 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.735038042 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.735151052 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.735151052 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.735166073 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.735497952 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.737751961 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.737771988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.737833023 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.737848043 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.737884045 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.737884045 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.739897013 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.739931107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.740010977 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.740010977 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.740020037 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.740633011 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.740680933 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.740695953 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.743489027 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.743514061 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.743550062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.743617058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.743617058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.743628025 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.743665934 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.746423960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.746454000 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.746498108 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.746507883 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.746531010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.746563911 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.771761894 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.771785975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.771857023 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.771864891 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.771903038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.771903038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.772661924 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.772763968 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.772772074 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.796251059 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.796472073 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.796488047 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.797383070 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.797427893 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.797513962 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.797513962 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.797524929 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.797574043 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.828351974 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.828382969 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.828450918 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.828463078 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.828501940 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.828531027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.828953981 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.829124928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.831160069 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.831188917 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.831237078 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.831237078 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.831247091 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.831336975 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.833267927 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.833288908 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.833486080 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.833492994 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.833543062 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.835835934 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.835855961 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.835932970 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.835939884 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.835957050 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.835983992 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.837908030 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.837935925 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.837985039 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.837994099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.838027954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.838027954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.864793062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.864816904 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.864876032 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.864886045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.864923954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.864939928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.898545980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.898572922 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.898684025 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.898684025 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.898691893 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.898745060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.900295019 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.900314093 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.900407076 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.900414944 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:26.900440931 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.900474072 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:26.988411903 CEST	49754	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.988462925 CEST	443	49754	172.217.16.194	192.168.2.5
Jul 25, 2024 15:17:26.988554001 CEST	49754	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.988817930 CEST	49754	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:26.988833904 CEST	443	49754	172.217.16.194	192.168.2.5
Jul 25, 2024 15:17:27.001638889 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.001676083 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.002206087 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.002221107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.002588034 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.003354073 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:27.003413916 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:27.003511906 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.003528118 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.003587961 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.003607035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.003870964 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.004056931 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:27.004066944 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:27.005294085 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.005310059 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.005600929 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.005611897 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.005701065 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.005980015 CEST	49754	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:27.006568909 CEST	49753	443	192.168.2.5	172.217.16.194
Jul 25, 2024 15:17:27.007186890 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.007214069 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.007277966 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.007288933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.007322073 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.007322073 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.008862972 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.008883953 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.008964062 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.008975983 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.009011984 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.010790110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.010807991 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.010864973 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.010875940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.010921001 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.011853933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.011871099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.012367964 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.012381077 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.012515068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.016554117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.016571045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.017849922 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.017860889 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.018141031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.055665970 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.055692911 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.055751085 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.055768013 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.055820942 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.055820942 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.057895899 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.057921886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.058049917 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.058049917 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.058059931 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.058167934 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.060353041 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.060405970 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.060450077 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.060461044 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.060478926 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.060503006 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.064963102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.064985991 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.065046072 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.065053940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.065085888 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.065085888 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.066809893 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.066852093 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.066891909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.066900015 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.066926003 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.067024946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.069399118 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.069422960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.069495916 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.069504976 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.069555998 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.094800949 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.094842911 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.094878912 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.094888926 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.094928026 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.094928026 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.098484993 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.098510981 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.098606110 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.098615885 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.098728895 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.148598909 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.148622036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.149200916 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.149215937 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.149272919 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.150511026 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.150530100 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.150634050 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.150640965 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.150778055 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.152333021 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.152357101 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.152447939 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.152447939 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.152456045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.152502060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.153891087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.153908014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.153996944 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.153996944 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.154004097 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.154129982 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.155811071 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.155858994 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.155869961 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.155888081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.155910969 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.155949116 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.157272100 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.157293081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.157382965 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.157390118 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.157466888 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.190927982 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.190952063 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.191082001 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.191097021 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.191150904 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.192526102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.192545891 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.192624092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.192631006 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.192641973 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.192683935 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.245990038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.246026993 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.246098995 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.246115923 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.246170044 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.246170044 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.248826027 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.248859882 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.248941898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.248955011 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.249013901 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.250818968 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.250840902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.250952959 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.250963926 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.251008987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.251791000 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.251815081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.251996994 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.252006054 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.252063036 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.252995014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.253021002 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.253103971 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.253113031 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.253211975 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.254216909 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.254242897 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.254316092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.254316092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.254323006 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.254369974 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.284905910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.284934044 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.285029888 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.285051107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.285162926 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.285162926 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.285928011 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.285948038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.286029100 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.286037922 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.286089897 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.337778091 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.337804079 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.337898016 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.337913036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.337934971 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.337964058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.339545012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.339569092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.339668036 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.339668036 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.339677095 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.340130091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.340607882 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.340626955 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.340843916 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.340853930 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.341007948 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.342722893 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.342746019 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.342869997 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.342879057 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.342945099 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.344329119 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.344357967 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.344448090 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.344456911 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.344516039 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.345227957 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.345251083 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.345817089 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.345827103 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.346091986 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.378690958 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.378714085 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.378823042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.378839016 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.378887892 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.378887892 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.379745960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.379765987 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.379868031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.379877090 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.380006075 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.436698914 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.436728001 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.437045097 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.437060118 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.437151909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.452227116 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.452256918 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.452322006 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.452332973 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.452363968 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.452378035 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.452745914 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.452763081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.452944994 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.452951908 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.453084946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.453685999 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.453701973 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.453807116 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.453813076 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.453864098 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.455507040 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.455523014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.455611944 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.455611944 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.455619097 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.455787897 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.456691980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.456717014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.456788063 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.456788063 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.456794977 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.456932068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.472532988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.472567081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.472635031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.472650051 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.472704887 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.472704887 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.475497007 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.475517035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.475629091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.475629091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.475642920 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.475689888 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.531068087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.531105995 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.531306982 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.531306982 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.531337023 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.531434059 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.532910109 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.532932043 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.533049107 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.533065081 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.533147097 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.533801079 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.533824921 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.533885956 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.533891916 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.533948898 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.533950090 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.536153078 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.536175966 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.536283970 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.536290884 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.536348104 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.536839962 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.536865950 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.537051916 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.537058115 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.537122011 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.538115025 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.538136005 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.538204908 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.538211107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.538259029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.538259029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.567045927 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567068100 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567178011 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.567194939 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567398071 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.567676067 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567701101 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567838907 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:27.567850113 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:27.567923069 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.071837902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.071855068 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.071896076 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.071938038 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.071960926 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.071975946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.072016001 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.072535992 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.072567940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.072613955 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.072622061 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.072633982 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.072663069 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.075228930 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.075248003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.075365067 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.075376987 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.075428009 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.076162100 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.076180935 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.076287985 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.076297045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.076343060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.077096939 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.077114105 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.077253103 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.077264071 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.077390909 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.078921080 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.078934908 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.079003096 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.079003096 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.079011917 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.079070091 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.079672098 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.079688072 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.079751015 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.079758883 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.079813004 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.080615997 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.080634117 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.080694914 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.080708027 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.081012964 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.081713915 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.081729889 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.082027912 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.082036972 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.082272053 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.084640980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084656000 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084713936 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.084722996 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084748983 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084772110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084795952 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.084795952 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.084803104 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.084867954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.084867954 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.086010933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.086028099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.086092949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.086103916 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.086173058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.088676929 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.088697910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.088767052 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.088778973 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.088825941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.088977098 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.088994980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.089077950 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.089085102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.089095116 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.089174032 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.090691090 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.090712070 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.090785027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.090795040 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.090969086 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.091001034 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.091022015 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.091031075 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.091039896 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.091253996 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.091253996 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.091909885 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.091928959 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.091985941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.091995955 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.092055082 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.092829943 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.092854023 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.092978001 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.092978001 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.092993975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.093038082 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.094001055 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094019890 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094214916 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.094225883 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094311953 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.094583035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094600916 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094830990 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.094842911 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.094903946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096165895 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096208096 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096317053 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096317053 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096328974 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096499920 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096754074 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096796036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096837044 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096843004 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.096935034 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.096935034 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.097728968 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.097774029 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.097837925 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.097837925 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.097852945 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.097894907 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.099395037 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.099447012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.099519968 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.099519968 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.099526882 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.099579096 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.101250887 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.101291895 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.101418972 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.101418972 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.101425886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.101485014 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.102327108 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.102374077 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.102421999 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.102427959 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.102446079 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.102514029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.105436087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.105456114 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.105536938 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.105542898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.105608940 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.106096983 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.106115103 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.106322050 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.106328011 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.106440067 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.112310886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.112327099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.112454891 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.112461090 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.112500906 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.113190889 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.113208055 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.113277912 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.113279104 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.113286972 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.113327980 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.114026070 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.114047050 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.114093065 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.114109039 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.114116907 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.114331007 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.114331961 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.115102053 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.115118980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.115215063 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.115221024 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.115956068 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.115978003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.116107941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.116107941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.116115093 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.117304087 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.117321014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.117381096 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.117387056 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.118778944 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.118807077 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.118880987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.118880987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.118889093 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.120310068 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.120330095 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.120434046 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.120440960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.124552965 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.124583960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.124631882 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.124639034 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.124675989 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.125173092 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125194073 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125283957 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.125283957 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.125291109 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125822067 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125852108 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125885010 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.125890017 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.125962973 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.128977060 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:28.129040956 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:28.129060984 CEST	443	49751	35.185.44.232	192.168.2.5
Jul 25, 2024 15:17:28.129115105 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:17:28.166591883 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.167263985 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.167278051 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.167298079 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.167304039 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.167352915 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.167361975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.167551041 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.167551041 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.168004036 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.168013096 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.168047905 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.168098927 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.168107033 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.168119907 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.168323040 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.177238941 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.177258015 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.177366018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.177372932 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.177459955 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.177865982 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.177881956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.177963018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.177969933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.178015947 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.179208040 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.179227114 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.179409027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.179419041 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.179456949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.181062937 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.181085110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.181173086 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.181180954 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.181337118 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.182925940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.182943106 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.183034897 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.183041096 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.183113098 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.184416056 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.184432030 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.184514999 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.184521914 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.184540033 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.184567928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.289050102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.289082050 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.289200068 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.289212942 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.289714098 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.289904118 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.289933920 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.290011883 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.290011883 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.290019035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.290200949 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.292388916 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.292427063 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.292478085 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.292490959 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.292560101 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.292560101 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301233053 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301266909 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301430941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301430941 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301448107 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301589966 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301611900 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301681042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301681042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301681042 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.301690102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.301989079 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.303848982 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.303873062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.303956032 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.304047108 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.304047108 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.304055929 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.304510117 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.306235075 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.306252956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.306333065 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.306334019 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.306350946 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.352157116 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383255959 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383272886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383311033 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383328915 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383366108 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383394003 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383420944 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383524895 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383760929 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383769989 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383795977 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383836031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383845091 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.383882046 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.383882999 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.385447979 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.385463953 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.385555983 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.385565996 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.386327028 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.386394024 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.386409998 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.386605978 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.386615038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.386703968 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.387500048 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.387521029 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.387615919 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.387634993 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.387794018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.391169071 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.391185045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.391283989 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.391295910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.391967058 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.391987085 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.392112970 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.392123938 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.392446041 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.393241882 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.393260956 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.393337011 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.393347025 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.393661022 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.685765028 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.685779095 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.685813904 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.685884953 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.685911894 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.685969114 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.685969114 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.686310053 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.686325073 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.686428070 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.686439037 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.686510086 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.687247038 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.687263012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.687346935 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.687357903 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.688414097 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.688518047 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.688534975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.688608885 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.688621044 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689012051 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689030886 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689093113 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.689093113 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.689105988 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689127922 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689141989 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689260960 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.689270973 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.689475060 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.690191984 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.690207005 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.690330029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.690330029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.690341949 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.690435886 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.691133022 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.691158056 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.691210032 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.691220999 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.691246033 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.691453934 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.692150116 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.692164898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.692245007 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.692253113 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.692310095 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.693269014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.693284035 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.693326950 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.693361044 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.693383932 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.693383932 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.693397045 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.693440914 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.693440914 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.694180012 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.694215059 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.694308043 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.694308043 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.694322109 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.694860935 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.694888115 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.694947004 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.694953918 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.695034027 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.695643902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.695663929 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.695705891 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.695760012 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.695760012 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.695760012 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.695771933 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.695983887 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.697240114 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.697273970 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.697339058 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.697349072 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.697391987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.697413921 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.698086977 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.698107004 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.698187113 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.698194981 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.698359966 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.698359966 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.699816942 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.699841976 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.699961901 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.699975014 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.700184107 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.700650930 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.700673103 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.701153040 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.701165915 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.701219082 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.702334881 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.702356100 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.702450991 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.702459097 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.702616930 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.704008102 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.704024076 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.704106092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.704114914 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.704802036 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.704994917 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.705012083 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.705096006 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.705096006 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.705106020 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.705188990 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.707060099 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.707079887 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.707151890 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.707160950 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.707441092 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.707786083 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.707807064 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.707935095 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.707936049 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.707946062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.708069086 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.756228924 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.756261110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.756381989 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.756401062 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.757788897 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.757811069 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.757839918 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.757858992 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.757960081 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.757960081 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.759404898 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.759423018 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.759548903 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.759557962 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.760557890 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.760586023 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.760751009 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.760751009 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.760766983 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.761324883 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.762533903 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.762562990 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.762648106 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.762648106 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.762655020 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.763485909 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.763514996 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.763571024 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.763571024 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.763580084 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.763631105 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.765341043 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.765367031 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.765553951 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.765563011 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.765760899 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.766413927 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.766432047 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.766536951 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.766536951 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.766542912 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.766633987 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.851927042 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.851950884 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.852296114 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.852296114 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.852314949 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.852514029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.854154110 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.854172945 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.854305029 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.854314089 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.854984999 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.855005980 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.855036974 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.855037928 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.855057001 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.855551004 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.855551004 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.855844975 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.855873108 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.856005907 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.856005907 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.856013060 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.856198072 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.857619047 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.857634068 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.857754946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.857754946 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.857769966 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.858298063 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.858756065 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.858772039 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.858836889 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.858851910 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.859374046 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.860578060 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.860599041 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.861141920 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.861156940 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.861284018 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.861569881 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.861584902 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.861677885 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.861695051 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.861974955 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.951864958 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.951936960 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.951980114 CEST	443	49750	163.181.92.223	192.168.2.5
Jul 25, 2024 15:17:28.951983929 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.952013016 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.952045918 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:28.952867031 CEST	49750	443	192.168.2.5	163.181.92.223
Jul 25, 2024 15:17:33.585931063 CEST	49751	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:07.516510010 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:07.516561985 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:07.516628981 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:07.528743982 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:07.528786898 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:07.528839111 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:07.555139065 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:07.555171013 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:07.555187941 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:07.555212021 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:08.230992079 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.231134892 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.234081984 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.234112978 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.234416962 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.276639938 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.610229969 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.639070034 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:08.639260054 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:08.641339064 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:08.641355038 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:08.641624928 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:08.643975019 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:08.656501055 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.684513092 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:08.846383095 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.846410990 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.846492052 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.846508026 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.846662045 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.939829111 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.939846039 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.939871073 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.939924955 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.939943075 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.939960003 CEST	443	49764	217.197.91.145	192.168.2.5
Jul 25, 2024 15:18:08.939970970 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.940000057 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:08.940812111 CEST	49764	443	192.168.2.5	217.197.91.145
Jul 25, 2024 15:18:09.246668100 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.246705055 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.246861935 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:09.246872902 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.247450113 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:09.440819025 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.440834999 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.440885067 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.440928936 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:09.440948009 CEST	443	49763	18.166.250.135	192.168.2.5
Jul 25, 2024 15:18:09.440969944 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:09.441009045 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:09.441548109 CEST	49763	443	192.168.2.5	18.166.250.135
Jul 25, 2024 15:18:11.764713049 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.764754057 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:11.764817953 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.772142887 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.772186041 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:11.772289991 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.772495031 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.772505999 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:11.773890972 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:11.773904085 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.274534941 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.274935007 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.274966955 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.276010036 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.276087046 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.287818909 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.287915945 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.303622961 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.303637981 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.309448957 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.309904099 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.309916973 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.310952902 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.311023951 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.311454058 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.311506987 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.351478100 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.351531029 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.351540089 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.394722939 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.479063988 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.483023882 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.483118057 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:12.483196020 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.485882044 CEST	49767	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:12.485902071 CEST	443	49767	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:13.456010103 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:13.456123114 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:13.456190109 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:15.037329912 CEST	49766	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:15.037352085 CEST	443	49766	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:16.189189911 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.189233065 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:16.189320087 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.190184116 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.190210104 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:16.206984043 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.207027912 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:16.207091093 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.207474947 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:16.207492113 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.407541990 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.408297062 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.408324957 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.409363985 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.409527063 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.410501003 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.410556078 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.410751104 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.410758972 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.456867933 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.466782093 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.467128992 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.467148066 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.468194962 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.468259096 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.468641043 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.468693972 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.519845963 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.519857883 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.566200018 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.581521988 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.581597090 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.582268953 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.582307100 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.582307100 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:17.582328081 CEST	443	49777	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:17.583534956 CEST	49777	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:18.584570885 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:18.584743023 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:18.584836006 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:20.655534983 CEST	49779	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:20.655571938 CEST	443	49779	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:20.832420111 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:20.832453966 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:20.832526922 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.546487093 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.546518087 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:21.648221016 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.648266077 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:21.648325920 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.649410963 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.649471045 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:21.649533987 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.650038958 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.650052071 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:21.650337934 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:21.650350094 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.090883017 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.092519045 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.129827976 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.129863024 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.130233049 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.156589985 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.157038927 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.157061100 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.158171892 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.158265114 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.158788919 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.158868074 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.159034014 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.159041882 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.177299023 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.197447062 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.198128939 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.198139906 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.199197054 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.199280977 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.199943066 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.199995995 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.206653118 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.254863977 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.254878044 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.300401926 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.333925009 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.334136009 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.334194899 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.334625006 CEST	49788	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.334640980 CEST	443	49788	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.350677013 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.392493963 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.531531096 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.531609058 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.531650066 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:22.531670094 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.531687021 CEST	443	49787	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:22.534214020 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:23.052066088 CEST	49787	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:23.314588070 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:23.314687967 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:23.314732075 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:23.523081064 CEST	49789	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:23.523106098 CEST	443	49789	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.199629068 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.199673891 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.199738979 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.200083017 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.200094938 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.202747107 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.202783108 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.202842951 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.203278065 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.203286886 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.705781937 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.708292007 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.708327055 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.709459066 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.709532976 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.709861040 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.709929943 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.710064888 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.710082054 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.752048969 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.752209902 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.755198956 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.755239010 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.756421089 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.756522894 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.757005930 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.757077932 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.797646999 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.797677040 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.845050097 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.876929045 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.877041101 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:24.877085924 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.879179001 CEST	49792	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:24.879196882 CEST	443	49792	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:25.872409105 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:25.872545958 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:25.872610092 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.322827101 CEST	49793	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.322856903 CEST	443	49793	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.323431015 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.323457003 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.323529959 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.324215889 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.324229956 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.328994989 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.329032898 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.329091072 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.329322100 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.329343081 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.821547985 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.822010994 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.822027922 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.823075056 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.823191881 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.825005054 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.825076103 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.825700998 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.825711012 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.878468037 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.880534887 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.881067038 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.881095886 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.884886980 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.884987116 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.885416031 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.885499001 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.925148964 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.925160885 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.972068071 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.992010117 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.992099047 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:27.992213011 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.993733883 CEST	49794	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:27.993757010 CEST	443	49794	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:29.000268936 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:29.000380993 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:29.000492096 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:29.240008116 CEST	49795	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:29.240036011 CEST	443	49795	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:37.993477106 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:37.993518114 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:37.993624926 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:38.895136118 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:38.895178080 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:38.895631075 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:40.245608091 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:40.245671034 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:40.625341892 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:40.625366926 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.131670952 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.131799936 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:41.141925097 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.142000914 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:41.172559977 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:41.172578096 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.176893950 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.222192049 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:41.302772999 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:41.302850008 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.303484917 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.347063065 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:41.544845104 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:41.592535019 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.819083929 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:41.864499092 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.931428909 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.931514025 CEST	443	49804	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:41.931577921 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:41.977905035 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.977952957 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.978025913 CEST	443	49796	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:41.978056908 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:41.978127003 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:43.106386900 CEST	49804	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:43.614974022 CEST	49796	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:47.790065050 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.790123940 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:47.790235996 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.839109898 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.839140892 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:47.853029013 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.853117943 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:47.853198051 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.896316051 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:47.896358967 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.490807056 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.491061926 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.497314930 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.497339010 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.498164892 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.526279926 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.552617073 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.552854061 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.558254957 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.558276892 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.558670998 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.572509050 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.583838940 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:48.628514051 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.986026049 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.986236095 CEST	443	49807	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:48.986330986 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.026401997 CEST	49807	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.084980965 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:49.085073948 CEST	443	49808	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:49.085251093 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.126272917 CEST	49808	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.646410942 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.646485090 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:49.646559000 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.689316034 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:49.689393997 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:50.374206066 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:50.374315977 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:50.380455017 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:50.380506039 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:50.380836964 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:50.406272888 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:50.448506117 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:51.063508987 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:51.063587904 CEST	443	49811	148.153.35.66	192.168.2.5
Jul 25, 2024 15:18:51.063787937 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:51.106257915 CEST	49811	443	192.168.2.5	148.153.35.66
Jul 25, 2024 15:18:53.671320915 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:53.671374083 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:53.671454906 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:53.671683073 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:53.671694994 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.194117069 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.194406986 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.194434881 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.195468903 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.195538998 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.196593046 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.196651936 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.196852922 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.196862936 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.236397028 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.494560003 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.494600058 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.494642973 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.494669914 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.494712114 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.494837999 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.494864941 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.494904041 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.494910002 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.496726036 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.496809006 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.496817112 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.496855974 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.499806881 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.499854088 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.499860048 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.499876976 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.499924898 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.500020981 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.500036955 CEST	443	49826	35.185.44.232	192.168.2.5
Jul 25, 2024 15:18:54.500046968 CEST	49826	443	192.168.2.5	35.185.44.232
Jul 25, 2024 15:18:54.500197887 CEST	49826	443	192.168.2.5	35.185.44.232

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 15:17:05.121706963 CEST	49530	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:05.137460947 CEST	53687	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:05.138478994 CEST	53228	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:05.140048027 CEST	56180	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:05.147799015 CEST	53	49530	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:05.151341915 CEST	53	53687	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:05.151638985 CEST	53	56180	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:05.158674002 CEST	53	53228	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:07.840617895 CEST	49295	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:07.927582026 CEST	64082	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:07.935935020 CEST	53	64082	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:08.276521921 CEST	53	49295	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:24.013842106 CEST	65114	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:24.200264931 CEST	53	65114	1.1.1.1	192.168.2.5
Jul 25, 2024 15:17:26.311145067 CEST	65309	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:17:26.404793978 CEST	53	65309	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:07.489098072 CEST	65463	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:07.507283926 CEST	53	65463	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:07.516571045 CEST	56181	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:07.528131962 CEST	53	56181	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:11.317214966 CEST	53848	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:11.317614079 CEST	53104	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:11.318504095 CEST	52195	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:11.655781984 CEST	53	52195	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:11.706398964 CEST	53	53104	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:11.763910055 CEST	53	53848	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:15.036781073 CEST	57944	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:15.037084103 CEST	63020	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:15.037959099 CEST	52840	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:15.038254976 CEST	53266	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:15.043896914 CEST	53	57944	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:15.044002056 CEST	53	63020	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:15.044960022 CEST	53	52840	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:15.045356035 CEST	53	53266	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:16.202941895 CEST	64561	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:16.209388018 CEST	56095	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:16.209999084 CEST	56342	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:16.900748968 CEST	53	56095	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:16.900762081 CEST	53	56342	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:17.215337038 CEST	58113	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:17.370878935 CEST	53	64561	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:17.580503941 CEST	53	58113	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:20.252326012 CEST	64045	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:20.535438061 CEST	53	64045	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:38.570329905 CEST	61618	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:38.578553915 CEST	53	61618	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:49.214260101 CEST	49154	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:49.231856108 CEST	54461	53	192.168.2.5	1.1.1.1
Jul 25, 2024 15:18:49.249301910 CEST	53	54461	1.1.1.1	192.168.2.5
Jul 25, 2024 15:18:49.586570024 CEST	53	49154	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 15:17:05.121706963 CEST	192.168.2.5	1.1.1.1	0x387a	Standard query (0)	dev.azure.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.137460947 CEST	192.168.2.5	1.1.1.1	0xa489	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.138478994 CEST	192.168.2.5	1.1.1.1	0x7a5d	Standard query (0)	war3tools.github.io	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.140048027 CEST	192.168.2.5	1.1.1.1	0x970d	Standard query (0)	master.dl.sourceforge.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.840617895 CEST	192.168.2.5	1.1.1.1	0x78c9	Standard query (0)	war3tools.suyx.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.927582026 CEST	192.168.2.5	1.1.1.1	0x1100	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.013842106 CEST	192.168.2.5	1.1.1.1	0xd240	Standard query (0)	nim-nosdn.netease.im	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:26.311145067 CEST	192.168.2.5	1.1.1.1	0x2988	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:07.489098072 CEST	192.168.2.5	1.1.1.1	0x41a5	Standard query (0)	gitea.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:07.516571045 CEST	192.168.2.5	1.1.1.1	0x6589	Standard query (0)	codeberg.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:11.317214966 CEST	192.168.2.5	1.1.1.1	0x6035	Standard query (0)	war3tools.suyx.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:11.317614079 CEST	192.168.2.5	1.1.1.1	0xa435	Standard query (0)	war3tools.suyx.net	65	IN (0x0001)	false
Jul 25, 2024 15:18:11.318504095 CEST	192.168.2.5	1.1.1.1	0x82b6	Standard query (0)	war3tools.suyx.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.036781073 CEST	192.168.2.5	1.1.1.1	0x7240	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.037084103 CEST	192.168.2.5	1.1.1.1	0xe5cc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 25, 2024 15:18:15.037959099 CEST	192.168.2.5	1.1.1.1	0xe053	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.038254976 CEST	192.168.2.5	1.1.1.1	0xdd67	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 25, 2024 15:18:16.202941895 CEST	192.168.2.5	1.1.1.1	0xa0e3	Standard query (0)	war3tools.suyx.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:16.209388018 CEST	192.168.2.5	1.1.1.1	0x7004	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:16.209999084 CEST	192.168.2.5	1.1.1.1	0x6f01	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Jul 25, 2024 15:18:17.215337038 CEST	192.168.2.5	1.1.1.1	0x19a5	Standard query (0)	war3tools.suyx.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:20.252326012 CEST	192.168.2.5	1.1.1.1	0x34d4	Standard query (0)	war3tools.gitlab.io	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:38.570329905 CEST	192.168.2.5	1.1.1.1	0x6003	Standard query (0)	api.bilibili.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:49.214260101 CEST	192.168.2.5	1.1.1.1	0xcde6	Standard query (0)	visitor-badge.laobi.icu	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:49.231856108 CEST	192.168.2.5	1.1.1.1	0x2aa8	Standard query (0)	hits.dwyl.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 15:17:05.147799015 CEST	1.1.1.1	192.168.2.5	0x387a	No error (0)	dev.azure.com		13.107.42.20	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.151341915 CEST	1.1.1.1	192.168.2.5	0xa489	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.151638985 CEST	1.1.1.1	192.168.2.5	0x970d	No error (0)	master.dl.sourceforge.net		216.105.38.12	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.158674002 CEST	1.1.1.1	192.168.2.5	0x7a5d	No error (0)	war3tools.github.io		185.199.108.153	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.158674002 CEST	1.1.1.1	192.168.2.5	0x7a5d	No error (0)	war3tools.github.io		185.199.111.153	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.158674002 CEST	1.1.1.1	192.168.2.5	0x7a5d	No error (0)	war3tools.github.io		185.199.110.153	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:05.158674002 CEST	1.1.1.1	192.168.2.5	0x7a5d	No error (0)	war3tools.github.io		185.199.109.153	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.935935020 CEST	1.1.1.1	192.168.2.5	0x1100	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.935935020 CEST	1.1.1.1	192.168.2.5	0x1100	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.935935020 CEST	1.1.1.1	192.168.2.5	0x1100	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:07.935935020 CEST	1.1.1.1	192.168.2.5	0x1100	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:08.276521921 CEST	1.1.1.1	192.168.2.5	0x78c9	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:17:08.276521921 CEST	1.1.1.1	192.168.2.5	0x78c9	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im	nim-nosdn.netease.im.163jiasu.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.163jiasu.com	nim-nosdn.netease.im.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.223	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.239	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.240	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.241	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.243	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.245	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.246	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:24.200264931 CEST	1.1.1.1	192.168.2.5	0xd240	No error (0)	nim-nosdn.netease.im.w.kunluncan.com		163.181.92.249	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:17:26.404793978 CEST	1.1.1.1	192.168.2.5	0x2988	No error (0)	googleads.g.doubleclick.net		172.217.16.194	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:07.507283926 CEST	1.1.1.1	192.168.2.5	0x41a5	No error (0)	gitea.com		18.166.250.135	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:07.528131962 CEST	1.1.1.1	192.168.2.5	0x6589	No error (0)	codeberg.org		217.197.91.145	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:11.655781984 CEST	1.1.1.1	192.168.2.5	0x82b6	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:11.655781984 CEST	1.1.1.1	192.168.2.5	0x82b6	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:11.706398964 CEST	1.1.1.1	192.168.2.5	0xa435	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:11.763910055 CEST	1.1.1.1	192.168.2.5	0x6035	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:11.763910055 CEST	1.1.1.1	192.168.2.5	0x6035	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.043896914 CEST	1.1.1.1	192.168.2.5	0x7240	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.043896914 CEST	1.1.1.1	192.168.2.5	0x7240	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.044002056 CEST	1.1.1.1	192.168.2.5	0xe5cc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 25, 2024 15:18:15.044960022 CEST	1.1.1.1	192.168.2.5	0xe053	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.044960022 CEST	1.1.1.1	192.168.2.5	0xe053	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:15.045356035 CEST	1.1.1.1	192.168.2.5	0xdd67	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 25, 2024 15:18:16.900748968 CEST	1.1.1.1	192.168.2.5	0x7004	No error (0)	googleads.g.doubleclick.net		216.58.206.66	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:16.900762081 CEST	1.1.1.1	192.168.2.5	0x6f01	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Jul 25, 2024 15:18:17.370878935 CEST	1.1.1.1	192.168.2.5	0xa0e3	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:17.370878935 CEST	1.1.1.1	192.168.2.5	0xa0e3	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:17.580503941 CEST	1.1.1.1	192.168.2.5	0x19a5	No error (0)	war3tools.suyx.net	war3tools.gitlab.io		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:17.580503941 CEST	1.1.1.1	192.168.2.5	0x19a5	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:20.535438061 CEST	1.1.1.1	192.168.2.5	0x34d4	No error (0)	war3tools.gitlab.io		35.185.44.232	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:38.578553915 CEST	1.1.1.1	192.168.2.5	0x6003	No error (0)	api.bilibili.com	a.w.bilicdn1.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:38.578553915 CEST	1.1.1.1	192.168.2.5	0x6003	No error (0)	a.w.bilicdn1.com	i.w.bilicdn1.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 15:18:38.578553915 CEST	1.1.1.1	192.168.2.5	0x6003	No error (0)	i.w.bilicdn1.com		148.153.35.66	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:38.578553915 CEST	1.1.1.1	192.168.2.5	0x6003	No error (0)	i.w.bilicdn1.com		148.153.34.154	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:49.249301910 CEST	1.1.1.1	192.168.2.5	0x2aa8	No error (0)	hits.dwyl.com		172.67.187.145	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:49.249301910 CEST	1.1.1.1	192.168.2.5	0x2aa8	No error (0)	hits.dwyl.com		104.21.7.133	A (IP address)	IN (0x0001)	false
Jul 25, 2024 15:18:49.586570024 CEST	1.1.1.1	192.168.2.5	0xcde6	No error (0)	visitor-badge.laobi.icu		119.28.77.158	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dev.azure.com

github.com

war3tools.github.io

master.dl.sourceforge.net

raw.githubusercontent.com

war3tools.suyx.net

nim-nosdn.netease.im

codeberg.org

gitea.com

war3tools.gitlab.io

api.bilibili.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49738	13.107.42.20	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:07 UTC	191	OUT	GET /war3tools/9b91b8fa-37b4-449c-8b69-5f281377e2fb/_apis/git/repositories/5bda583c-2292-4cc4-8c71-78b44a037995/items?path=/README.md HTTP/1.1 Host: dev.azure.com Connection: Keep-Alive
2024-07-25 13:17:07 UTC	1474	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Length: 19742 Content-Type: application/octet-stream; api-version=7.1 Expires: -1 P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT" Set-Cookie: VstsSession=%7B%22PersistentSessionId%22%3A%226556e0c1-b2ee-4378-98c1-e11bef78a6e1%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22SignInState%22%3A%7B%7D%7D; domain=.dev.azure.com; expires=Fri, 25-Jul-2025 13:17:07 GMT; path=/; secure; HttpOnly X-TFS-ProcessId: 27575c14-a926-455e-b719-b7c8dc68d335 Strict-Transport-Security: max-age=31536000; includeSubDomains ActivityId: ce62636c-651d-44e2-9d43-5d60d45537d7 X-TFS-Session: ce62636c-651d-44e2-9d43-5d60d45537d7 X-VSS-E2EID: ce62636c-651d-44e2-9d43-5d60d45537d7 X-VSS-SenderDeploymentId: f466e928-5898-edb4-7123-84c15666043f X-FRAME-OPTIONS: SAMEORIGIN Content-Disposition: attachment; filename=README.md; filename*=utf-8''README.md Request-Context: appId=cid-v1:ba8cca98-f9cc-4f08-a334-706ff8d04ac6 Access-Control-Expose-Headers: Request-Context X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: EA7C285601DD487A88E1732E8F476FB4 Ref B: EWR30EDGE1015 Ref C: 2024-07-25T13:17:07Z Date: Thu, 25 Jul 2024 13:17:07 GMT Connection: close
2024-07-25 13:17:07 UTC	2722	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0d 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 2a 20 47 69 74 6c 61 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 0d 0a 23 23 23 20 e9 a2 84 e8 a7 88 0d 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0d 0a 21 5b 5d 28 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 2f 2d 2f 72 61 77 2f 6d 61 69 6e 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 22 29 0d 0a 2a 20 e9 Data Ascii: ### * https://war3tools.gitlab.io* Gitlab https://gitlab.com/war3tools/war3tools.gitlab.io### * ![](https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png "")*
2024-07-25 13:17:07 UTC	1374	IN	Data Raw: b4 a3 e4 bb bb 60 2a 2a 0d 0a 0d 0a 23 23 23 20 e4 b8 8b e8 bd bd 0d 0a 2a 20 e5 9c b0 e5 9d 80 20 20 0d 0a 5b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 65 67 61 64 69 73 6b 2e 6e 65 74 2f 63 6c 6f 75 64 31 31 2f 69 6e 64 65 78 2e 70 68 70 2f 73 2f 59 76 74 35 73 6d 68 75 64 61 38 76 78 41 6e 5d 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 65 67 61 64 69 73 6b 2e 6e 65 74 2f 63 6c 6f 75 64 31 31 2f 69 6e 64 65 78 2e 70 68 70 2f 73 2f 59 76 74 35 73 6d 68 75 64 61 38 76 78 41 6e 29 20 20 0d 0a 5b 68 74 74 70 73 3a 2f 2f 65 2e 70 63 6c 6f 75 64 2e 6c 69 6e 6b 2f 70 75 62 6c 69 6e 6b 2f 73 68 6f 77 3f 63 6f 64 65 3d 6b 5a 75 50 66 6e 5a 50 4d 4e 75 6f 70 35 47 61 68 53 48 61 4d 63 61 53 78 62 6f 6a 70 37 41 58 49 46 58 5d 28 68 74 74 70 73 3a 2f 2f 65 2e 70 63 6c Data Ascii: `*### [https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn](https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn) [https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX](https://e.pcl
2024-07-25 13:17:07 UTC	4096	IN	Data Raw: 20 e4 bc 98 e5 8c 96 e6 a3 80 e6 9f a5 e6 9b b4 e6 96 b0 e5 af bc e8 87 b4 e7 9a 84 e5 8d a1 e9 a1 bf e9 97 ae e9 a2 98 0d 0a 20 20 2b 20 e5 85 b6 e5 ae 83 e5 b0 8f e4 bc 98 e5 8c 96 0d 0a 2a 20 5b 76 32 2e 31 2e 31 2e 31 35 34 5d 0d 0a 20 20 2b 20 e6 b7 bb e5 8a a0 57 46 45 e6 98 be e8 93 9d e6 8f 92 e4 bb b6 ef bc 8c e6 94 af e6 8c 81 31 2e 32 36 e5 92 8c 31 2e 32 37 e6 98 be e8 93 9d 0d 0a 20 20 2b 20 e8 84 9a e6 9c ac e5 8a 9f e8 83 bd e6 b7 bb e5 8a a0 e6 8c 89 e6 a0 87 e9 a2 98 e5 85 b3 e9 97 ad e7 aa 97 e5 8f a3 e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e5 86 85 e5 ad 98 e4 bc 98 e5 8c 96 e3 80 81 e9 97 aa e9 80 80 e4 bf ae e5 a4 8d e5 8f 8a e5 85 b6 e5 ae 83 e5 b0 8f e4 bc 98 e5 8c 96 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e6 9d a1 e4 bb b6 e5 88 Data Ascii: + * [v2.1.1.154] + WFE1.261.27 + + +
2024-07-25 13:17:07 UTC	4096	IN	Data Raw: 80 bb e8 be 91 0d 0a 20 20 2b 20 e4 bf ae e6 ad a3 e4 ba 86 e5 88 9b e5 bb ba e4 b8 bb e6 9c ba e5 90 8e e8 8e b7 e5 8f 96 e5 9c b0 e5 9b be e8 b7 af e5 be 84 e4 b9 b1 e7 a0 81 e7 9a 84 e9 97 ae e9 a2 98 0d 0a 20 20 2b 20 e4 bf ae e6 ad a3 e5 96 8a e8 af 9d e6 97 b6 e4 bc 9a e6 8c 89 e4 b8 8b 45 73 63 e7 9a 84 e9 97 ae e9 a2 98 0d 0a 20 20 2b 20 e5 85 b6 e5 ae 83 e5 b0 8f e4 bc 98 e5 8c 96 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 34 36 5d 0d 0a 20 20 2b 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e6 8c 89 e4 b8 8b e7 9a 84 e9 94 ae e6 94 af e6 8c 81 e7 bb 84 e5 90 88 e5 8a 9f e8 83 bd e9 94 ae e7 9a 84 e7 8a b6 e6 80 81 e8 ae be e7 bd ae 0d 0a 20 20 2b 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e6 8c 89 e4 b8 8b e7 9a 84 e9 94 ae e6 94 af e6 8c 81 e6 8c 89 e4 b8 8b Data Ascii: + + Esc + * [v2.1.0.146] + +
2024-07-25 13:17:08 UTC	4096	IN	Data Raw: e9 94 ae e6 96 b9 e6 a1 88 e8 ae be e7 bd ae ef bc 8c e5 8f af e8 ae be e7 bd ae e8 8b b1 e9 9b 84 e4 b8 ba e6 94 b9 e9 94 ae e6 9d a1 e4 bb b6 28 e4 bb 85 e6 94 af e6 8c 81 31 2e 32 32 2d 31 2e 32 38 29 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 36 5d 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 31 2e 33 30 2b e7 89 88 e6 9c ac e5 ae bd e5 b1 8f e7 9a 84 e8 81 8a e5 a4 a9 e7 8a b6 e6 80 81 e6 a3 80 e6 b5 8b e9 80 bb e8 be 91 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 35 5d 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e8 8b b1 e9 9b 84 e6 8a 80 e8 83 bd e6 94 b9 e9 94 ae e7 9a 84 e9 80 bb e8 be 91 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e5 b1 8f e8 94 bd e8 87 aa e5 ae 9a e4 b9 89 e6 8c 89 e9 94 ae e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 34 5d 0d 0a Data Ascii: (1.22-1.28)* [v2.1.0.136] + 1.30+* [v2.1.0.135] + + * [v2.1.0.134]
2024-07-25 13:17:08 UTC	3358	IN	Data Raw: 64 46 68 47 50 6f 30 53 30 6c 43 34 78 61 63 43 34 71 34 78 43 6a 4c 58 6c 51 7a 62 51 43 56 59 36 72 74 37 35 43 4f 78 4a 4c 5a 48 65 39 74 4e 67 62 51 67 59 59 63 70 7a 32 7a 31 59 38 67 75 42 37 4f 42 64 54 55 66 77 46 7a 6b 6d 62 39 34 49 47 35 4e 38 48 55 74 6e 54 6d 7a 61 4a 55 6c 52 36 75 52 47 69 72 64 79 4b 6d 36 2f 4b 74 33 74 34 62 57 49 64 5a 2f 77 45 75 75 4f 78 4e 78 55 39 4e 30 74 61 46 45 6c 56 2f 59 79 79 69 74 4e 36 64 48 51 50 7a 4d 48 45 78 51 6c 6d 50 7a 32 39 70 65 4b 6b 4f 44 2b 77 2f 53 70 2f 6e 73 6f 32 38 31 77 71 38 4a 2f 56 37 55 6e 65 48 4d 69 72 71 70 56 45 6a 73 74 54 76 50 42 49 68 71 72 32 50 39 68 72 78 50 6b 63 64 54 75 4e 59 61 46 48 4f 44 53 2b 4f 6d 4b 68 2f 50 4f 4f 58 47 33 37 2b 47 33 6f 34 67 7a 67 48 6c 6f 52 64 Data Ascii: dFhGPo0S0lC4xacC4q4xCjLXlQzbQCVY6rt75COxJLZHe9tNgbQgYYcpz2z1Y8guB7OBdTUfwFzkmb94IG5N8HUtnTmzaJUlR6uRGirdyKm6/Kt3t4bWIdZ/wEuuOxNxU9N0taFElV/YyyitN6dHQPzMHExQlmPz29peKkOD+w/Sp/nso281wq8J/V7UneHMirqpVEjstTvPBIhqr2P9hrxPkcdTuNYaFHODS+OmKh/POOXG37+G3o4gzgHloRd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49737	140.82.121.4	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:07 UTC	115	OUT	GET /war3tools/war3tools.github.io/raw/master/docs/README.md HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-07-25 13:17:07 UTC	566	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 25 Jul 2024 13:17:07 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/war3tools/war3tools.github.io/master/docs/README.md Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-07-25 13:17:07 UTC	3107	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49739	185.199.108.153	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:07 UTC	78	OUT	GET /README.md HTTP/1.1 Host: war3tools.github.io Connection: Keep-Alive
2024-07-25 13:17:07 UTC	582	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 162 Server: GitHub.com Content-Type: text/html permissions-policy: interest-cohort=() Location: https://war3tools.suyx.net/README.md x-hosts-log-append: pages_hosts_ips: X-GitHub-Request-Id: AD5F:9D286:88D140:A43323:66A25052 Accept-Ranges: bytes Age: 0 Date: Thu, 25 Jul 2024 13:17:07 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890089-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1721913427.308072,VS0,VE13 Vary: Accept-Encoding X-Fastly-Request-ID: c72a18faaa04f78071fb972661a7aa413976d8f2
2024-07-25 13:17:07 UTC	162	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49736	216.105.38.12	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:07 UTC	110	OUT	GET /project/war3tools/README.md?viasf=1 HTTP/1.1 Host: master.dl.sourceforge.net Connection: Keep-Alive
2024-07-25 13:17:07 UTC	222	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Jul 2024 13:17:07 GMT Content-Type: application/octet-stream Content-Length: 19742 Connection: close last-modified: Wed, 05 Jun 2024 09:45:01 GMT etag: "6660339d-4d1e"
2024-07-25 13:17:07 UTC	3874	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0d 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 2a 20 47 69 74 6c 61 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 0d 0a 23 23 23 20 e9 a2 84 e8 a7 88 0d 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0d 0a 21 5b 5d 28 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 2f 2d 2f 72 61 77 2f 6d 61 69 6e 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 22 29 0d 0a 2a 20 e9 Data Ascii: ### * https://war3tools.gitlab.io* Gitlab https://gitlab.com/war3tools/war3tools.gitlab.io### * ![](https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png "")*
2024-07-25 13:17:07 UTC	4096	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e5 bd 93 e6 96 b9 e6 a1 88 e5 8b be e9 80 89 e4 bb 85 e5 af b9 e8 8b b1 e9 9b 84 e7 94 9f e6 95 88 e6 97 b6 e8 83 8c e5 8c 85 e6 94 b9 e9 94 ae e4 b9 9f e5 8f af e4 bb a5 e9 85 8d e7 bd ae e5 af b9 e6 89 80 e6 9c 89 e5 8d 95 e4 bd 8d e6 9c 89 e6 95 88 0d 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e5 96 8a e8 af 9d e5 8f af e8 87 aa e5 ae 9a e4 b9 89 e9 97 b4 e9 9a 94 e5 bb b6 e6 97 b6 e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 41 6c 74 2b e6 95 b0 e5 ad 97 e9 94 ae e8 bf 9e e7 bb ad e5 96 8a e8 af 9d e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e6 a3 80 e6 9f a5 e6 9b b4 e6 96 b0 e5 af bc e8 87 b4 e7 9a 84 e5 8d a1 e9 a1 Data Ascii: https://war3tools.gitlab.io + + + Alt+ +
2024-07-25 13:17:07 UTC	4096	IN	Data Raw: 82 e8 80 83 47 69 74 6c 61 62 e5 b8 ae e5 8a a9 e8 af b4 e6 98 8e 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e4 ba 86 e6 89 a9 e5 b1 95 e7 a8 8b e5 ba 8f e5 9c a8 e6 a3 80 e6 b5 8b 57 61 72 33 e5 90 af e5 8a a8 e6 97 b6 e8 87 aa e5 8a a8 e6 89 a7 e8 a1 8c e7 9a 84 e9 80 bb e8 be 91 0d 0a 20 20 2b 20 e6 9a 82 e5 81 9c e5 bc 80 e5 85 b3 e4 b8 8a e5 8a a0 e5 85 a5 e5 8f b3 e9 94 ae e8 ae be e7 bd ae e5 bf ab e9 80 9f e5 90 af e5 8a a8 e9 ad 94 e5 85 bd e5 8a 9f e8 83 bd e9 80 89 e9 a1 b9 0d 0a 20 20 2b 20 e4 bf ae e6 ad a3 e4 ba 86 e2 80 9c e6 b8 b8 e6 88 8f e6 9c aa e5 bc 80 e5 a7 8b e4 b9 9f e7 94 9f e6 95 88 e2 80 9d e7 9a 84 e6 94 b9 e9 94 ae e8 a7 a6 e5 8f 91 e9 80 bb e8 be 91 0d 0a 20 20 2b 20 e4 bf ae e6 ad a3 e4 ba 86 e5 88 9b e5 bb ba e4 b8 bb e6 9c ba e5 Data Ascii: Gitlab + War3 + + +
2024-07-25 13:17:07 UTC	4096	IN	Data Raw: b7 9d e9 94 81 e5 ae 9a e5 8a 9f e8 83 bd 28 e5 85 a8 e5 b1 80 e8 ae be e7 bd ae e5 8f b3 e8 be b9 e7 9a 84 e5 85 a5 e5 8f a3 29 0d 0a 20 20 2b 20 e5 85 b6 e5 ae 83 e7 95 8c e9 9d a2 e5 8a a0 e5 85 a5 e4 b8 80 e4 ba 9b e5 b0 8f e5 8a 9f e8 83 bd 28 e9 ad 94 e5 85 bd e7 9b b8 e5 85 b3 ef bc 8c e5 af b9 e6 88 98 e5 b9 b3 e5 8f b0 e5 90 af e5 8a a8 29 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 37 5d 0d 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e6 94 b9 e9 94 ae e4 bb 85 e5 af b9 e8 8b b1 e9 9b 84 e7 94 9f e6 95 88 e7 9a 84 e9 80 89 e9 a1 b9 e8 ae be e7 bd ae 28 e9 bb 98 e8 ae a4 e6 9c aa e5 bc 80 e5 90 af 29 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e6 96 b9 e6 a1 88 e8 ae be e7 bd ae ef bc 8c e5 8f af e8 ae be e7 bd ae e8 8b b1 e9 9b 84 Data Ascii: () + ()* [v2.1.0.137] + () +
2024-07-25 13:17:07 UTC	3580	IN	Data Raw: 64 43 78 49 66 35 38 77 6c 33 50 37 45 32 67 66 6b 4e 39 72 66 70 54 65 46 67 74 75 52 36 43 30 2f 4e 36 48 4b 38 74 45 51 38 79 50 36 68 62 77 43 69 69 67 71 77 73 70 52 42 56 69 4c 79 4d 50 67 49 70 6e 2f 4a 58 45 54 55 49 5a 65 39 36 32 7a 61 77 69 52 55 30 62 74 42 58 65 43 7a 6a 4a 30 53 6b 70 79 6a 69 5a 6c 6d 31 65 53 68 75 64 30 68 63 4a 59 4c 52 5a 4f 51 2f 6f 6e 37 74 72 51 6c 7a 32 56 36 6a 37 45 48 4a 54 4d 72 7a 72 6b 35 73 6a 4a 6d 74 48 48 4e 4b 79 50 73 55 33 51 30 70 66 78 4d 71 4c 31 36 32 72 53 46 45 79 37 69 74 6e 58 73 4b 43 64 42 4b 45 45 59 78 39 65 6c 62 55 65 32 34 4e 54 42 49 6f 4d 50 2b 32 57 74 76 4a 45 4e 7a 5a 48 71 50 4f 49 6f 64 46 68 47 50 6f 30 53 30 6c 43 34 78 61 63 43 34 71 34 78 43 6a 4c 58 6c 51 7a 62 51 43 56 59 36 Data Ascii: dCxIf58wl3P7E2gfkN9rfpTeFgtuR6C0/N6HK8tEQ8yP6hbwCiigqwspRBViLyMPgIpn/JXETUIZe962zawiRU0btBXeCzjJ0SkpyjiZlm1eShud0hcJYLRZOQ/on7trQlz2V6j7EHJTMrzrk5sjJmtHHNKyPsU3Q0pfxMqL162rSFEy7itnXsKCdBKEEYx9elbUe24NTBIoMP+2WtvJENzZHqPOIodFhGPo0S0lC4xacC4q4xCjLXlQzbQCVY6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49740	185.199.110.133	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:08 UTC	126	OUT	GET /war3tools/war3tools.github.io/master/docs/README.md HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-07-25 13:17:08 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 18955 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "67d326fc1d0162834d9342568b1721fdc6dc31ac8508f3627599faad605cd49e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 879B:ED0E7:684620:73B016:66A25051 Accept-Ranges: bytes Date: Thu, 25 Jul 2024 13:17:08 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890093-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1721913429.616483,VS0,VE56 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 1b7dd8af19a01db5ac1c87df15661521fa5095db Expires: Thu, 25 Jul 2024 13:22:08 GMT Source-Age: 0
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0d 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 68 75 62 2e 69 6f 0d 0a 2a 20 47 69 74 68 75 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 68 75 62 2e 69 6f 0d 0a 2a 20 21 5b 48 69 74 43 6f 75 6e 74 5d 28 68 74 74 70 73 3a 2f 2f 68 69 74 73 2e 64 77 79 6c 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 68 75 62 2e 69 6f 2e 73 76 67 29 0d 0a 0d 0a 23 23 23 20 e9 a2 84 e8 a7 88 0d 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0d 0a 21 5b 5d 28 2e 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 Data Ascii: ### * https://war3tools.github.io* Github https://github.com/war3tools/war3tools.github.io* ![HitCount](https://hits.dwyl.com/war3tools/war3tools.github.io.svg)### * ![](./images/SuWar3Tools.png "
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 85 b7 e5 ae 9e e7 8e b0 e6 98 be e8 93 9d e5 8a 9f e8 83 bd ef bc 8c e6 94 af e6 8c 81 31 2e 32 30 7e 31 2e 32 37 e7 89 88 e6 9c ac 20 2a 2a 60 28 e6 b3 a8 e6 84 8f e5 af b9 e6 88 98 e5 b9 b3 e5 8f b0 e4 b8 8a e8 b0 a8 e6 85 8e e4 bd bf e7 94 a8 29 60 2a 2a 0d 0a 2a 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae ef bc 9a e7 82 b9 e5 87 bb e4 b8 80 e6 94 b9 e5 a4 9a e5 8c ba e5 9f 9f e5 8f b3 e8 be b9 e7 9a 84 e6 97 a0 e7 a9 b7 e7 ac a6 e5 8f b7 e5 8d b3 e5 8f af e8 bf 9b e5 85 a5 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e8 ae be e7 bd ae 20 20 0d 0a e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e5 8f 82 e8 80 83 e7 a4 ba e4 be 8b ef bc 9a 20 5b 4f 74 68 65 72 73 2f 41 64 76 61 6e 63 65 64 43 6f 64 65 44 65 6d 6f 2f 52 45 41 44 4d 45 2e 6d 64 5d 28 68 74 74 70 73 3a 2f 2f 67 69 Data Ascii: 1.20~1.27 `()`* [Others/AdvancedCodeDemo/README.md](https://gi
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 2e 70 63 6c 6f 75 64 2e 6c 69 6e 6b 2f 70 75 62 6c 69 6e 6b 2f 73 68 6f 77 3f 63 6f 64 65 3d 6b 5a 75 50 66 6e 5a 50 4d 4e 75 6f 70 35 47 61 68 53 48 61 4d 63 61 53 78 62 6f 6a 70 37 41 58 49 46 58 5d 28 68 74 74 70 73 3a 2f 2f 65 2e 70 63 6c 6f 75 64 2e 6c 69 6e 6b 2f 70 75 62 6c 69 6e 6b 2f 73 68 6f 77 3f 63 6f 64 65 3d 6b 5a 75 50 66 6e 5a 50 4d 4e 75 6f 70 35 47 61 68 53 48 61 4d 63 61 53 78 62 6f 6a 70 37 41 58 49 46 58 29 20 20 0d 0a 5b 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 65 67 61 64 69 73 6b 2e 6e 65 74 2f 63 6c 6f 75 64 31 31 2f 69 6e 64 65 78 2e 70 68 70 2f 73 2f 59 76 74 35 73 6d 68 75 64 61 38 76 78 41 6e 5d 28 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 65 67 61 64 69 73 6b 2e 6e 65 74 2f 63 6c 6f 75 64 31 31 2f 69 6e 64 65 78 2e 70 68 70 2f 73 Data Ascii: .pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX](https://e.pcloud.link/publink/show?code=kZuPfnZPMNuop5GahSHaMcaSxbojp7AXIFX) [https://www.megadisk.net/cloud11/index.php/s/Yvt5smhuda8vxAn](https://www.megadisk.net/cloud11/index.php/s
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: a9 e5 b1 95 e6 9c 8d e5 8a a1 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e5 85 b6 e5 ae 83 e5 b0 8f e4 bc 98 e5 8c 96 0d 0a 2a 20 5b 76 32 2e 31 2e 31 2e 31 35 32 5d 0d 0a 20 20 2b 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e9 87 8c e5 8a a0 e5 85 a5 e6 9d a1 e4 bb b6 e8 84 9a e6 9c ac ef bc 8c e5 85 b7 e4 bd 93 e4 bd bf e7 94 a8 e8 af b7 e6 9f a5 e7 9c 8b e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e5 b8 ae e5 8a a9 e6 96 87 e6 a1 a3 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e5 86 85 e7 bd ae 48 74 74 70 e6 9c 8d e5 8a a1 ef bc 8c e5 8f af e4 be 9b e5 85 b6 e5 ae 83 e5 9c ba e6 99 af e4 bd bf e7 94 a8 ef bc 8c e5 85 b7 e4 bd 93 e5 8f af e6 9f a5 e7 9c 8b 48 74 74 70 e6 9c 8d e5 8a a1 e6 89 a9 e5 b1 95 e5 b8 ae e5 8a a9 0d 0a 20 20 2b 20 e5 85 a8 e5 b1 80 e8 ae be e7 bd ae e5 8f Data Ascii: + * [v2.1.1.152] + + HttpHttp +
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: e3 80 81 e8 bf 90 e8 a1 8c e5 8f 82 e6 95 b0 e7 9a 84 e8 87 aa e5 ae 9a e4 b9 89 e8 bf 87 e6 bb a4 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e5 8a a0 e5 85 a5 e7 89 b9 e5 ae 9a e6 97 b6 e9 97 b4 e6 89 a7 e8 a1 8c e8 84 9a e6 9c ac e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e6 8c 89 e9 94 ae e9 95 bf e6 8c 89 e6 97 b6 e5 8f aa e8 a7 a6 e5 8f 91 e4 b8 80 e6 ac a1 e8 84 9a e6 9c ac e7 9a 84 e9 80 89 e9 a1 b9 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e4 b8 ad e6 96 87 e5 96 8a e8 af 9d e7 9a 84 e4 bd bf e7 94 a8 e4 bd 93 e9 aa 8c ef bc 8c e9 99 8d e4 bd 8e e8 81 8a e5 a4 a9 e8 be 93 e5 85 a5 e6 a1 86 e7 9a 84 e9 97 aa e7 83 81 e6 95 88 e6 9e 9c 0d 0a 20 20 2b 20 e5 88 a4 e6 96 ad e6 8a 80 e8 83 bd e9 9d a2 e6 9d bf Data Ascii: + + + +
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 63 e5 88 a4 e6 96 ad ef bc 8c e5 a6 82 e6 9e 9c e4 b8 8d e5 ad 98 e5 9c a8 e5 88 99 e4 b8 ad e6 96 ad e5 90 8e e7 bb ad e7 82 b9 e5 87 bb e5 8a a8 e4 bd 9c 0d 0a 20 20 2b 20 e9 ab 98 e7 ba a7 e6 94 b9 e9 94 ae e5 a2 9e e5 8a a0 e5 88 a4 e6 96 ad e6 8a 80 e8 83 bd e9 9d a2 e6 9d bf e6 98 af e5 90 a6 e5 ad 98 e5 9c a8 e5 bf ab e6 8d b7 e9 94 ae ef bc 8c e5 a6 82 e6 9e 9c e5 ad 98 e5 9c a8 e5 88 99 e7 bb a7 e7 bb ad ef bc 8c e5 90 a6 e5 88 99 e4 b8 ad e6 96 ad 0d 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e4 bf ae e6 94 b9 e6 8c 89 e9 94 ae e6 97 b6 e6 94 af e6 8c 81 e9 80 9a e8 bf 87 e9 bc a0 e6 a0 87 e5 8f b3 e9 94 ae e9 80 89 e6 8b a9 e6 8c 89 e9 94 ae ef bc 8c e9 81 bf e5 85 8d e9 94 ae e7 9b 98 e5 9d 8f e6 8e 89 e6 97 b6 e6 97 a0 e6 b3 95 e8 ae be e7 bd ae 0d 0a Data Ascii: c + +
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: e5 8a a0 e5 a4 9a e6 96 b9 e6 a1 88 e5 8a 9f e8 83 bd ef bc 8c e6 9c 80 e5 a4 9a e6 94 af e6 8c 81 39 e4 b8 aa e5 96 8a e8 af 9d e6 96 b9 e6 a1 88 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 34 35 5d 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 31 2e 33 30 2b e7 89 b9 e6 ae 8a e5 9c ba e6 99 af e4 b8 8b e6 94 b9 e9 94 ae e5 a4 b1 e6 95 88 e7 9a 84 42 75 67 ef bc 8c e4 bb 8d e6 97 a0 e6 b3 95 e4 bd bf e7 94 a8 e5 8f af e5 90 af e7 94 a8 e5 bc ba e5 88 b6 e6 94 b9 e9 94 ae 0d 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e8 87 aa e5 ae 9a e4 b9 89 e6 8c 89 e4 bd 8d e7 bd ae e7 82 b9 e5 88 a4 e6 96 ad e8 81 8a e5 a4 a9 e7 8a b6 e6 80 81 e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e4 b8 80 e9 94 ae e9 9a 90 e8 97 8f e9 ad 94 e5 85 bd e7 9a 84 e5 8a 9f e8 83 bd 28 e9 Data Ascii: 9* [v2.1.0.145] + 1.30+Bug + + (
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 94 b9 e4 b8 ba e5 85 a8 e5 b1 80 e5 8f af e7 94 a8 28 e4 bf ae e6 94 b9 e5 90 8e e9 9c 80 e4 bf 9d e5 ad 98 29 0d 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e7 aa 97 e5 8f a3 e5 8c 96 e5 8a 9f e8 83 bd ef bc 8c e5 8e 9f e5 88 86 e8 be a8 e7 8e 87 e8 ae be e7 bd ae e5 8a 9f e8 83 bd e7 a7 bb e5 88 b0 e5 85 b6 e5 ae 83 e9 9d a2 e6 9d bf e9 87 8c 0d 0a 20 20 2b 20 e6 8a 80 e8 83 bd e6 94 b9 e9 94 ae e8 af 86 e5 88 ab e9 87 8d e5 a4 8d 28 49 4d 42 41 29 e5 92 8c e7 bc ba e5 b0 91 e7 9a 84 e6 83 85 e5 86 b5 28 e9 bb 98 e8 ae a4 e6 9c aa e5 bc 80 e5 90 af 29 0d 0a 20 20 2b 20 e7 82 b9 e5 87 bb e5 8f b3 e4 b8 8a e8 a7 92 e5 85 b3 e9 97 ad e6 94 b9 e4 b8 ba e5 bc 80 e5 90 af e6 94 b9 e9 94 ae e5 8a 9f e8 83 bd 28 e5 85 bc e5 ae b9 e9 9b b6 e5 ba a6 e4 b9 a0 e6 83 af 29 0d Data Ascii: () + + (IMBA)() + ()
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 8c 81 e6 93 8d e4 bd 9c e4 bb bb e6 84 8f e4 bd 8d e7 bd ae 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 39 5d 0d 0a 20 20 2b 20 e9 92 88 e5 af b9 e6 8a 80 e8 83 bd e6 94 b9 e9 94 ae e7 9a 84 e9 80 bb e8 be 91 e8 bf 9b e8 a1 8c e4 ba 86 e8 b0 83 e6 95 b4 e5 92 8c e4 bc 98 e5 8c 96 ef bc 8c e5 a6 82 e6 9c 89 e9 97 ae e9 a2 98 e8 af b7 e5 8f 8a e6 97 b6 e5 8f 8d e9 a6 88 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e6 8a 80 e8 83 bd e9 87 8d e6 98 a0 e5 b0 84 e5 8a 9f e8 83 bd ef bc 8c e5 af b9 e6 9f 90 e4 b8 aa e5 8d 95 e4 bd 8d e5 8d 95 e7 8b ac e6 98 a0 e5 b0 84 e9 94 ae e5 80 bc e5 92 8c e9 bc a0 e6 a0 87 e7 82 b9 e5 87 bb 0d 0a 20 20 2b 20 e4 b8 80 e5 af b9 e5 a4 9a e6 94 b9 e9 94 ae e5 8f af e4 bb a5 e6 b7 bb e5 8a a0 e9 80 89 e6 8b a9 e8 8b b1 e9 9b 84 e5 92 8c Data Ascii: * [v2.1.0.139] + + +
2024-07-25 13:17:08 UTC	1378	IN	Data Raw: 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 33 5d 0d 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e6 96 b9 e6 a1 88 e5 bf ab e9 80 9f e5 88 87 e6 8d a2 e5 8a 9f e8 83 bd ef bc 9a e5 a6 82 e5 90 8d e7 a7 b0 e5 89 8d e5 8a a0 e2 80 9c 5b 44 5d e2 80 9d e5 88 99 e5 bf ab e6 8d b7 e9 94 ae e4 b8 ba 43 74 72 6c 2b 53 68 69 66 74 2b 44 0d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 e9 ad 94 e5 85 bd 31 2e 33 30 2b e7 89 88 e6 9c ac e5 88 a4 e6 96 ad e8 81 8a e5 a4 a9 e7 8a b6 e6 80 81 e7 9a 84 e9 80 bb e8 be 91 0d 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 33 32 5d 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e6 9b b4 e6 96 b0 e6 8f 90 e7 a4 ba e6 a1 86 e6 98 be e7 a4 ba e6 9b b4 e6 96 b0 e6 97 a5 e5 bf 97 e7 9a 84 e5 8a 9f e8 83 bd 0d 0a 20 20 2b 20 e5 8a a0 e5 85 a5 e9 bc a0 e6 a0 87 e6 a8 a1 e6 8b 9f Data Ascii: * [v2.1.0.133] + [D]Ctrl+Shift+D + 1.30+* [v2.1.0.132] + +

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49741	35.185.44.232	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:08 UTC	77	OUT	GET /README.md HTTP/1.1 Host: war3tools.suyx.net Connection: Keep-Alive
2024-07-25 13:17:09 UTC	384	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 19531 Content-Type: text/markdown; charset=utf-8 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:27:09 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:17:09 GMT Connection: close
2024-07-25 13:17:09 UTC	802	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0a 2a 20 47 69 74 6c 61 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0a 0a 23 23 23 20 e9 a2 84 e8 a7 88 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0a 21 5b 5d 28 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 2f 2d 2f 72 61 77 2f 6d 61 69 6e 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 22 29 0a 2a 20 e9 ab 98 e7 ba a7 e6 94 Data Ascii: ### * https://war3tools.gitlab.io* Gitlab https://gitlab.com/war3tools/war3tools.gitlab.io### * ![](https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png "")*
2024-07-25 13:17:09 UTC	2372	IN	Data Raw: 2b 20 e6 b8 b8 e6 88 8f e8 bf 87 e7 a8 8b e4 b8 ad e6 bb 9a e5 8a a8 e9 bc a0 e6 a0 87 e4 bc 9a e8 bf 98 e5 8e 9f ef bc 8c e5 8f af e5 86 8d e6 ac a1 e6 8c 89 e4 b8 8b e5 bf ab e6 8d b7 e9 94 ae e7 bb a7 e7 bb ad e8 b0 83 e6 95 b4 0a 20 20 2b 20 e6 af 8f e5 bc 80 e4 b8 80 e5 b1 80 e6 88 96 e6 97 a0 e6 95 88 e6 97 b6 ef bc 8c e5 90 8c e6 97 b6 e6 8c 89 e4 b8 8b 43 74 72 6c 2b e8 a7 86 e9 87 8e e8 b0 83 e6 95 b4 e5 bf ab e6 8d b7 e9 94 ae e9 87 8d e7 bd ae 0a 20 20 2b 20 e5 a6 82 e6 9e 9c e8 b0 83 e6 95 b4 e6 97 a0 e6 95 88 e6 97 b6 e8 af b7 e5 85 b3 e9 97 ad 33 36 30 e4 b9 8b e7 b1 bb e7 9a 84 e8 bd af e4 bb b6 0a 2a 20 e8 8b b1 e9 9b 84 e6 8a 80 e8 83 bd e6 94 b9 e9 94 ae ef bc 8c e9 9d 9e e9 bc a0 e6 a0 87 e6 a8 a1 e5 bc 8f e4 b8 8b e5 8f aa e6 94 af e6 Data Ascii: + + Ctrl+ + 360*
2024-07-25 13:17:09 UTC	538	IN	Data Raw: 2f 66 6f 6c 64 65 72 2f 37 39 65 64 31 62 33 38 2d 32 36 62 38 2d 34 63 62 63 2d 38 31 38 65 2d 35 36 38 37 62 30 37 32 65 62 31 66 2f 63 30 63 38 34 66 64 63 65 39 34 38 36 36 33 32 36 39 30 64 65 31 35 64 31 65 30 38 62 39 34 66 32 30 39 33 35 30 63 32 39 39 36 37 63 66 63 36 35 65 33 63 38 37 34 66 36 62 62 36 62 37 63 62 29 20 20 0a 5b 68 74 74 70 73 3a 2f 2f 73 6f 75 72 63 65 66 6f 72 67 65 2e 6e 65 74 2f 70 72 6f 6a 65 63 74 73 2f 77 61 72 33 74 6f 6f 6c 73 2f 66 69 6c 65 73 2f 5d 28 68 74 74 70 73 3a 2f 2f 73 6f 75 72 63 65 66 6f 72 67 65 2e 6e 65 74 2f 70 72 6f 6a 65 63 74 73 2f 77 61 72 33 74 6f 6f 6c 73 2f 66 69 6c 65 73 2f 29 0a 2a 20 e5 a6 82 e6 9e 9c e8 bf 90 e8 a1 8c e5 a4 b1 e8 b4 a5 ef bc 8c e8 af b7 e4 b8 8b e8 bd bd e5 b9 b6 e5 ae 89 e8 Data Ascii: /folder/79ed1b38-26b8-4cbc-818e-5687b072eb1f/c0c84fdce9486632690de15d1e08b94f209350c29967cfc65e3c874f6bb6b7cb) [https://sourceforge.net/projects/war3tools/files/](https://sourceforge.net/projects/war3tools/files/)*
2024-07-25 13:17:09 UTC	4744	IN	Data Raw: bc 8c e4 bb a5 e4 be bf e4 ba 8e e6 9b b4 e6 96 b9 e4 be bf e5 92 8c e5 bf ab e9 80 9f e5 ae 9a e4 bd 8d e9 97 ae e9 a2 98 0a 0a 23 23 23 20 e6 9b b4 e6 96 b0 0a 2a 20 5b 76 32 2e 31 2e 31 2e 31 35 35 5d 0a 20 20 2b 20 e4 b8 80 e5 8f aa e5 b0 8f e9 b1 bc e5 84 bf e6 b8 b8 e5 88 b0 e4 ba 86 e5 85 b6 e5 ae 83 e5 9c b0 e6 96 b9 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e5 bd 93 e6 96 b9 e6 a1 88 e5 8b be e9 80 89 e4 bb 85 e5 af b9 e8 8b b1 e9 9b 84 e7 94 9f e6 95 88 e6 97 b6 e8 83 8c e5 8c 85 e6 94 b9 e9 94 ae e4 b9 9f e5 8f af e4 bb a5 e9 85 8d e7 bd ae e5 af b9 e6 89 80 e6 9c 89 e5 8d 95 e4 bd 8d e6 9c 89 e6 95 88 0a 20 20 2b 20 e6 b7 bb e5 8a a0 e5 96 8a e8 af 9d e5 8f af Data Ascii: ### * [v2.1.1.155] + https://war3tools.gitlab.io + +
2024-07-25 13:17:09 UTC	5930	IN	Data Raw: e5 96 8a e8 af 9d e6 96 b9 e6 a1 88 0a 2a 20 5b 76 32 2e 31 2e 30 2e 31 34 35 5d 0a 20 20 2b 20 e4 bc 98 e5 8c 96 31 2e 33 30 2b e7 89 b9 e6 ae 8a e5 9c ba e6 99 af e4 b8 8b e6 94 b9 e9 94 ae e5 a4 b1 e6 95 88 e7 9a 84 42 75 67 ef bc 8c e4 bb 8d e6 97 a0 e6 b3 95 e4 bd bf e7 94 a8 e5 8f af e5 90 af e7 94 a8 e5 bc ba e5 88 b6 e6 94 b9 e9 94 ae 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e8 87 aa e5 ae 9a e4 b9 89 e6 8c 89 e4 bd 8d e7 bd ae e7 82 b9 e5 88 a4 e6 96 ad e8 81 8a e5 a4 a9 e7 8a b6 e6 80 81 e7 9a 84 e5 8a 9f e8 83 bd 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e4 b8 80 e9 94 ae e9 9a 90 e8 97 8f e9 ad 94 e5 85 bd e7 9a 84 e5 8a 9f e8 83 bd 28 e9 bb 98 e8 ae a4 e6 9c aa e8 ae be e7 bd ae e5 bf ab e6 8d b7 e9 94 ae 29 0a 20 20 2b 20 e5 a2 9e e5 8a a0 e8 b0 83 e7 94 a8 Data Ascii: * [v2.1.0.145] + 1.30+Bug + + () +
2024-07-25 13:17:09 UTC	5145	IN	Data Raw: 37 61 46 4f 46 42 6c 66 4a 6f 52 43 58 69 54 56 51 52 71 75 70 73 36 77 75 63 53 6f 52 77 7a 73 34 52 37 31 56 49 6a 75 43 67 48 44 32 70 6a 30 53 6e 5a 6b 55 34 4c 58 36 6c 32 75 72 68 6f 71 67 2f 6e 73 48 6c 66 69 6b 6d 41 77 75 77 5a 31 4b 59 4d 58 32 46 39 77 77 65 2b 79 72 44 6c 42 6b 65 43 4c 45 32 2f 38 71 50 42 78 53 44 4d 77 2f 31 7a 79 67 59 41 77 35 53 57 2f 7a 52 6c 66 6c 59 50 4d 43 70 57 43 79 4d 73 72 2b 6c 64 56 74 38 6d 37 4d 37 57 43 43 51 43 78 44 7a 34 34 6b 6e 42 57 4e 6c 7a 35 47 44 61 45 4a 54 76 56 59 79 6c 30 4c 51 75 4b 36 66 4d 6b 32 6a 57 63 69 39 6b 61 30 73 52 69 39 35 67 77 56 36 38 75 46 6a 53 5a 76 64 56 34 64 79 6a 6f 48 35 4a 65 4e 31 76 50 5a 6c 73 4a 76 45 6e 2b 78 6e 6c 38 4c 50 41 51 48 35 70 74 51 4f 6c 54 72 41 79 Data Ascii: 7aFOFBlfJoRCXiTVQRqups6wucSoRwzs4R71VIjuCgHD2pj0SnZkU4LX6l2urhoqg/nsHlfikmAwuwZ1KYMX2F9wwe+yrDlBkeCLE2/8qPBxSDMw/1zygYAw5SW/zRlflYPMCpWCyMsr+ldVt8m7M7WCCQCxDz44knBWNlz5GDaEJTvVYyl0LQuK6fMk2jWci9ka0sRi95gwV68uFjSZvdV4dyjoH5JeN1vPZlsJvEn+xnl8LPAQH5ptQOlTrAy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49743	35.185.44.232	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:17 UTC	400	OUT	GET /ad/header.html HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Accept-Encoding: gzip, deflate Host: war3tools.suyx.net Connection: Keep-Alive
2024-07-25 13:17:17 UTC	379	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 1888 Content-Type: text/html; charset=utf-8 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:27:17 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:17:17 GMT Connection: close
2024-07-25 13:17:17 UTC	807	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 Data Ascii: <!DOCTYPE html><head> <title>3SuWar3Tools</title> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="description" content="3SuWar3Tools"> <meta name="keywords
2024-07-25 13:17:17 UTC	1081	IN	Data Raw: 36 31 5c 30 30 37 32 5c 30 30 33 33 5c 30 30 35 34 5c 30 30 36 66 5c 30 30 36 66 5c 30 30 36 63 5c 30 30 37 33 5c 61 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 27 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 34 34 39 35 65 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 36 72 65 6d 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 Data Ascii: 61\0072\0033\0054\006f\006f\006c\0073\ahttps://war3tools.gitlab.io'; white-space: pre; display: flex; justify-content: center; align-items: center; height: 100%; color: #34495e; font-size: 1.6rem; text-decor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49750	163.181.92.223	443	5532	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:17:24 UTC	273	OUT	GET /MjYxNDkzNzE=/bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=?download=SuWar3Tools.zip&randomtime=638574961174603590 HTTP/1.1 Host: nim-nosdn.netease.im Cache-Control: no-cache Pragma: no-cache Connection: Keep-Alive
2024-07-25 13:17:25 UTC	1174	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/octet-stream Content-Length: 4041269 Connection: close Date: Thu, 25 Jul 2024 13:17:25 GMT Content-Disposition: attachment; filename="SuWar3Tools.zip"; filename=UTF-8''SuWar3Tools.zip Etag: b6e72b4ebfccb3b2689a52c9956c08e2-1 Last-Modified: Wed, 05 Jun 2024 16:32:02 Asia/Shanghai X-Nos-Object-Name: MjYxNDkzNzE%3D%2FbmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI%3D X-Nos-Request-Id: 5fa940b1-cbba-4f21-839d-abc3448ba45e X-Nos-Requesttype: GetObject X-Nos-Storage-Class: STANDARD Via: cache17.l2st3-1[232,231,200-0,M], cache28.l2st3-1[233,0], cache20.l2sg2[268,268,200-0,M], cache27.l2sg2[269,0], cache15.l2de2[449,449,200-0,M], cache6.l2de2[451,0], ens-cache15.de5[454,453,200-0,M], ens-cache16.de5[455,0] Ali-Swift-Global-Savetime: 1721913445 X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Thu, 25 Jul 2024 13:17:25 GMT X-Swift-CacheTime: 604800 cdn-user-ip: 8.46.123.33 cdnfrom: Ali cdn-ip: 163.181.92.223 Access-Control-Allow-Methods: GET,POST Access-Control-Allow-Origin: Timing-Allow-Origin: * EagleId: a3b55ca417219134451294945e
2024-07-25 13:17:25 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 00 00 00 00 1d 9b 0a 57 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 53 75 57 61 72 33 54 6f 6f 6c 73 2f 50 4b 03 04 14 00 00 00 08 00 78 83 c5 58 17 3b 11 93 f1 a8 3d 00 00 a0 50 00 1b 00 00 00 53 75 57 61 72 33 54 6f 6f 6c 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 65 78 65 ec bd 0d 58 54 d5 f6 38 7c 86 39 e0 28 a3 67 cc 41 29 49 47 1d 0b 05 15 1d 35 6c f4 86 c6 57 86 3a 80 0c 6a 7e 50 e9 44 64 65 3a a3 de 1b 22 34 90 1e 37 53 56 54 5a d6 cd b2 b2 b2 9b 95 57 d1 bc 3a 03 ca 97 a6 80 96 e0 47 57 cb ea 20 54 60 26 68 c6 f9 af b5 f7 99 61 50 2b 7f ff f7 7d 7e cf f3 be 4f a3 cc 9c b3 f7 3e 6b ef bd f6 da eb 6b af bd cf 94 59 6b 39 35 c7 71 3c fc c9 32 c7 15 73 ec 13 c3 fd f9 27 17 fe 7a f4 df d5 83 db d6 f5 f3 01 c5 aa a4 cf 07 4c cf 7c Data Ascii: PKWSuWar3Tools/PKxX;=PSuWar3Tools/SuWar3Tools.exeXT8\|9(gA)IG5lW:j~PDde:"47SVTZW:GW T`&haP+}~O>kkYk95q<2s'zL\|
2024-07-25 13:17:25 UTC	15200	IN	Data Raw: 6b be 91 23 09 b1 64 f4 66 50 3e 53 bd 46 0d 09 f6 be 58 86 f4 62 76 f8 b8 65 b3 a9 35 4f cd 71 1d 33 c7 f5 b8 87 94 ba 1d 8b 3c de b7 6b ad 06 ea b1 d0 31 d7 76 63 aa d4 7e 95 f9 f1 c4 ec 57 e7 6e 55 79 5d 12 d0 54 1a ff 6a b4 92 96 74 92 33 1d 5f c1 40 ea ec 76 5b c4 bc 50 5b c4 e3 7a 2a 50 a2 48 0c 2f ec 38 e0 39 a3 13 76 7c 11 5c 25 32 83 3f 94 2e 60 e1 79 88 e4 30 1e 2b 85 ca b3 62 81 b6 2b 16 68 82 bf 05 9a ae 15 ff 31 03 e1 e5 45 07 60 f6 e3 ec e4 6e 66 e7 ea e9 f6 90 71 56 4b 4e 38 99 9a 44 c6 99 2f db f5 e6 c7 f5 39 82 f9 f1 b0 15 dd cc f3 42 73 02 cd f3 0c d9 71 18 cf e7 e1 cd f1 96 ec 13 30 2a 80 65 83 68 f5 62 39 14 0d 6d 7a 4a a3 2f 60 a8 da 54 0b f9 57 57 34 2e 67 b6 7d 76 6b 02 ea dd b9 a0 26 94 4b df 51 93 3d c3 f7 ac 8e 4d b7 d0 00 66 c4 Data Ascii: k#dfP>SFXbve5Oq3<k1vc~WnUy]Tjt3_@v[P[zPH/89v\|\%2?.`y0+b+h1E`nfqVKN8D/9Bsq0ehb9mzJ/`TWW4.g}vk&KQ=Mf
2024-07-25 13:17:25 UTC	16384	IN	Data Raw: c1 09 e1 c4 c8 0a e9 2c 49 e1 84 87 e9 c9 5f ba 9a 24 68 84 71 1a 92 14 e9 4f 12 49 92 a2 fc f7 51 24 49 e7 bf d7 49 4e eb ae f2 ff ad 4d d7 1f cb 30 0a b7 0b 99 ac 90 c9 09 99 6a 21 53 23 66 1f 57 32 db de 78 36 89 8e 8a 47 08 75 fd 4d e1 e7 32 cb 62 84 5a db 42 0b 69 1b 7e 87 6d 24 1d 92 8d d8 29 a3 4e 48 6d 3b 6b d3 42 a9 b7 08 8b d7 a9 1d 1e 85 fe ac e3 12 bb b4 57 63 17 34 0f 65 53 41 77 48 8d b5 d3 0d c2 24 ce fb 9a ce 69 6d 9a 90 cc 8a 56 78 40 e9 79 8a f5 4d c7 2f 88 7d 0a c9 6a 71 d2 d7 92 86 65 b2 26 6b 16 29 f7 b7 03 d9 a9 a4 5f 09 ac 34 19 16 32 7a 0b ae 38 e3 7d e8 13 85 f3 f5 5e 8d 98 88 4f 41 44 61 8e 4e 93 fb 90 99 1e 15 66 00 7e d1 5f 86 32 c3 95 dc 3b c8 20 5c 1f 89 f6 13 f4 45 84 4d 4b fc f8 b2 a3 5c 61 68 5d dc 08 60 ad 85 e8 6b f1 fb Data Ascii: ,I_$hqOIQ$IINM0j!S#fW2x6GuM2bZBi~m$)NHm;kBWc4eSAwH$imVx@yM/}jqe&k)_42z8}^OADaNf~_2; \EMK\ah]`k
2024-07-25 13:17:25 UTC	16384	IN	Data Raw: 85 df 78 9e 9f 2f cf 0f f2 4a 1a 8c b8 0c 00 91 ee 40 be 21 bd 32 01 8e 55 16 a3 63 16 d3 e5 98 9b 14 73 93 9a b9 4d 77 87 8c 64 9d 8c 24 98 51 07 06 15 2f 7f 09 96 df a3 db f2 31 60 ba a7 15 3d 92 34 5d 7d 14 dd b2 7e 6d d2 2d ec 59 1e a6 2b ba e5 9f 8b e9 5e ff 8a 6e 69 6f 6d d2 25 76 e8 52 3b 74 99 1d ba dc 0e dd c3 0e dd d3 0e 5d 61 87 ee 65 87 ee 63 87 ee db 2d 1d e1 ff 21 fd 95 46 c5 a8 91 5d 2f 47 a3 3d 5e a5 1e 91 5e 90 1d 7e fc f8 62 72 3b cd 6c ff 43 6c d9 7f 9b df ab ec a4 1f 61 87 ae b6 43 9f 6b 87 be d0 0e 7d a9 1d 7a 9c 1d 7a bc 1d fa 2a 3b f4 24 3b f4 e4 47 d3 b5 a9 dd db 7f 9b f1 6d f7 77 70 d0 1d 8b ee d2 30 eb 24 dc be 66 04 4f 5e 87 0e f5 4b 96 f0 c3 ec de c8 a8 08 d3 4f e5 a3 f0 66 47 6a 15 c3 92 0e 7b 00 14 a5 5b ba 45 b7 f1 08 ba 87 Data Ascii: x/J@!2UcsMwd$Q/1`=4]}~m-Y+^niom%vR;t]aec-!F]/G=^^~br;lClaCk}zz*;$;Gmwp0$fO^KOfGj{[E
2024-07-25 13:17:25 UTC	16384	IN	Data Raw: f9 97 f4 7d 38 1f 60 f5 1c d4 0b f2 69 62 ce fc 98 4f 63 c8 ff 3f f0 69 9c f3 dd 6d bf 9f c7 67 e1 7a 43 07 c9 b9 be 8b 98 fc 19 dd 1c 0f 6a c9 e0 d9 62 19 c6 77 e7 02 72 a7 2f 43 3f e9 e6 b2 6f c8 91 e0 c1 bf ee d7 85 e0 32 ca c8 13 5c 78 47 86 a8 66 4c c8 f8 d9 8d 44 67 15 4c 62 31 37 10 cc e5 9f f7 25 bd 3f 1a cf 73 49 49 cd 58 c9 fb ed c7 ba 82 00 43 d4 f1 04 1b 88 67 5b 43 d0 ac c0 f0 e6 ec 36 b4 4e 5b bc b4 f6 71 d3 8f bd 44 e2 56 cd 81 97 bc d0 e9 7d 35 2c 76 aa c3 66 ab 1c 3b c4 e3 c4 98 24 fa f1 cb 18 67 d1 d4 4b ed c5 83 c7 4d fb 0a b9 a1 91 a9 12 a0 8b 64 a3 6e 8e 07 26 63 a4 67 9a 77 4d d4 f5 0e 6b 56 4b 5e 77 05 cb dc 9f 08 50 5f 45 2e f5 6b 39 5a bb 1e ed 74 e6 da 99 cb ca 71 83 6f c0 e0 32 65 85 3c 28 a6 b0 4a 66 a2 5b fc 96 d0 15 52 0e 4f Data Ascii: }8`ibOc?imgzCjbwr/C?o2\xGfLDgLb17%?sIIXCg[C6N[qDV}5,vf;$gKMdn&cgwMkVK^wP_E.k9Ztqo2e<(Jf[RO
2024-07-25 13:17:25 UTC	16384	IN	Data Raw: 46 33 2b 0e b7 e6 81 42 c3 07 e6 3a 81 60 84 84 86 40 5e 74 11 73 78 32 f8 e7 27 4d 83 59 50 8b 5e 03 c5 35 1d 4e 8a 42 05 e4 62 09 d4 4d 7f 30 8e b0 f9 a8 bd 0f 54 31 e9 65 05 89 ee 84 39 e9 25 20 44 00 5a 13 22 4e 8c 97 6d b4 88 4b 7a d9 2a 9e 72 d4 95 80 a3 3a 5a d4 5e 4c 7a 0d 11 13 a2 0e a4 97 0b 21 02 51 dc 08 11 6f 83 09 e9 e5 59 69 4c 7a 79 10 22 4b d2 d5 0a 4f 99 34 44 41 99 44 94 b3 8c 15 8d be ef 06 bf 77 7e 5f e7 fb de 9c f7 7d df 3b 1c 6e 71 21 3d d8 c4 d4 67 da 43 7a 3b 92 21 1c 5f 75 71 a0 1e 09 ed 41 8e e3 d0 05 36 d9 4d 7d 5d 9b 1c c7 7d df 23 ed b7 b9 8b 8f 8d c3 b2 00 80 ea 80 9c fa 8c ec 18 28 b2 c2 d4 11 ed 98 ab 66 e2 e2 c7 d5 71 d9 f5 71 0b ea e3 16 18 88 3b 45 13 d7 b4 21 5f a3 fa 7c 8d 9a 8f bb 59 13 97 d3 90 6f 7d dc 02 03 71 b3 Data Ascii: F3+B:`@^tsx2'MYP^5NBbM0T1e9% DZ"NmKz*r:Z^Lz!QoYiLzy"KO4DADw~_};nq!=gCz;!_uqA6M}]}#(fqq;E!_\|Yo}q
2024-07-25 13:17:26 UTC	12866	IN	Data Raw: fb 98 93 34 ac 3f 4c a4 ac 7e 75 76 39 be 3b fc 94 10 53 6e 21 a0 f1 f8 59 54 4a 26 c5 81 f2 0c 79 86 9b 04 c3 0d fb 25 32 dc 48 0c 37 31 86 9b 0c dc d5 c1 67 d0 3b da 2b 30 f0 9b 25 08 7c a0 14 97 5a 4b 6c 53 5a 00 81 1a d7 a4 e0 99 f9 09 20 07 f7 41 90 6f 3f 70 b5 db ef 27 e0 8a 68 24 81 65 85 a4 a8 fb 12 26 c5 8c 30 22 48 9b 3a 96 76 3d 48 0b 75 8c a6 1d 48 c4 6d 2f 2c 2f 79 46 18 09 b9 f5 0e 45 19 d6 62 b8 19 4b 66 fc 84 e6 be c4 8f 16 95 31 7b 93 1d e9 b7 4b 2e f0 76 ef 1c 77 ea 96 0c e3 04 35 02 c2 57 80 e3 3e 3d 4c 44 21 c8 a4 38 54 dc 8c cf 1c 8a 08 14 a4 21 8a 74 dc c8 26 63 d2 13 24 e2 cb 8f 45 22 24 10 23 08 27 80 cd 2a ac 25 54 1d 07 17 2c 9f 59 68 2d f6 9a 98 af c4 6e 2b 70 f8 e6 d7 58 dc 76 a6 03 f7 63 f4 65 0c dc 1e 95 44 e3 e5 00 d7 ef 9a Data Ascii: 4?L~uv9;Sn!YTJ&y%2H71g;+0%\|ZKlSZ Ao?p'h$e&0"H:v=HuHm/,/yFEbKf1{K.vw5W>=LD!8T!t&c$E"$#'*%T,Yh-n+pXvceD
2024-07-25 13:17:26 UTC	4380	IN	Data Raw: dc f0 e8 b0 91 62 d8 8b 5b d4 8e 1a f1 84 f8 21 bb ed 22 6f cd 8e ba d3 3d aa d7 0c 23 bb 63 bc 91 48 ae c3 d6 55 f5 ea 80 23 69 b6 25 4f 56 dc bd 51 4d d9 0c 7a 5c 7a 46 b1 62 32 b5 a6 71 e9 89 a8 f8 37 9c a5 ad f7 66 ff fa ac f2 c2 b1 a3 46 dc 71 2f cc df ad 68 f9 f5 3d f9 7c ce 8f 27 2b a8 99 7d 65 f2 ac 1b db 9e 52 aa 36 13 64 ec 99 83 ca 4a 62 85 03 be d7 75 e4 a5 61 c1 b7 62 47 2f 5e bb ff e5 76 fe 6b eb c0 fa 9a 37 f5 42 ef b8 0a ed bb 6e 99 96 33 ce f8 0f 32 ed 72 79 7f 66 7d 4c 4d 46 e5 c7 8d b1 92 92 4d db 37 73 0d 27 0d e3 bf 90 6d 6b e3 7f 7c 76 f9 4c 3a 3f a3 9e aa aa 1b 3c af 66 6e d8 d4 23 3f 47 1f bf 7d ac b6 9a 51 f8 f6 a0 b9 74 cb e1 45 7b 7f 5b 38 d0 7d c1 bc 39 d9 0e 61 d3 7d 46 94 67 cd a9 e0 6a 76 8b 66 8d ae c3 56 57 7e 18 d0 3d 8b Data Ascii: b[!"o=#cHU#i%OVQMz\zFb2q7fFq/h=\|'+}eR6dJbuabG/^vk7Bn32ryf}LMFM7s'mk\|vL:?<fn#?G}QtE{[8}9a}FgjvfVW~=
2024-07-25 13:17:26 UTC	4560	IN	Data Raw: c4 63 ca d4 3f 4b 7a 02 92 31 04 4e 4d d3 30 1e 33 0a 9c 4c 58 8c 95 a6 6a ea 20 e8 f6 29 bc 5e be 0a 90 f4 eb 2b 20 fd 52 83 fb 2e 01 28 b7 63 bb 1f bc 69 4b 42 f1 a0 7a 7c 02 0f 2f 26 af e7 52 94 30 34 82 8c 1b ad 77 d8 38 9d 41 e3 39 a6 45 ca 24 48 29 14 29 31 f0 68 29 52 26 43 b4 a8 48 89 83 c7 e7 22 25 f4 91 86 16 29 09 f0 50 14 29 37 82 47 5e 91 72 13 78 f4 2a 52 6e 06 0f bb 22 e5 16 b8 e0 8a 94 5b c1 a3 b8 48 b9 0d 3c 04 45 ca 54 88 7d 15 29 b7 83 87 41 91 72 87 2e c9 4e 7a 01 43 90 fd 10 c9 68 9d 15 0d 8f 0d 33 01 e8 52 96 ac b8 d5 80 46 bd f3 a0 05 0f 82 80 40 41 0c 2f 51 de c2 59 d6 25 99 eb 96 c4 85 22 9c 75 7f 15 0b 74 b6 c4 04 2f 68 d6 9e e0 05 7e 9f dc 73 0e 60 d2 bb 15 34 c5 83 87 bf 50 56 a2 eb b3 c1 47 39 18 42 c5 19 88 c9 83 e7 11 fa 82 Data Ascii: c?Kz1NM03LXj )^+ R.(ciKBz\|/&R04w8A9E$H))1h)R&CH"%)P)7G^rx*Rn"[H<ET})Ar.NzCh3RF@A/QY%"ut/h~s`4PVG9B
2024-07-25 13:17:26 UTC	16384	IN	Data Raw: 39 2e 60 63 82 87 58 50 15 ee cf c6 27 b3 b0 a0 a7 fc 4a 2c 94 8b 85 32 e5 2d dd 51 a5 14 f4 57 a2 bb 03 aa 5c 00 02 67 4c dc bc 0d 50 e5 2c 10 74 f3 66 a1 ca 29 f0 e3 ca 6e e0 eb 64 3a 84 36 a1 4a 3f 3a 64 6a 8b 2a c7 d0 21 8e 3d aa 74 81 cc 82 35 2c 79 71 77 b0 0b 03 a4 44 37 30 ee c1 d6 52 14 37 c7 4d 84 f8 75 3c c4 8a aa 84 5f 18 78 b7 60 f0 2a b4 a5 2a a1 c7 37 55 2f 4c 70 03 9c 61 42 f2 7a 0b 05 68 a9 17 00 91 b1 c0 93 e0 49 e8 11 44 4a cd f0 cd 69 30 68 29 b1 84 89 f0 a0 1b c1 64 d3 23 0a 10 30 2c 5d da 49 ed b6 aa 2d 31 3a 25 1e 44 62 74 6e 3d 76 53 d7 b3 9d c0 2a c2 01 81 85 0b 5e e0 b0 63 ca f1 f0 87 21 11 a1 38 e8 95 72 d2 c0 14 41 34 8b 01 7e 24 16 82 4d 4f ac d8 cb b3 ca 10 41 02 74 bf 2f ba e1 59 e6 40 84 5f 25 92 95 79 ac 30 6f 10 75 29 05 Data Ascii: 9.`cXP'J,2-QW\gLP,tf)nd:6J?:dj!=t5,yqwD70R7Mu<_x`7U/LpaBzhIDJi0h)d#0,]I-1:%Dbtn=vS^c!8rA4~$MOAt/Y@_%y0ou)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49764	217.197.91.145	443	6472	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:08 UTC	109	OUT	GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1 Host: codeberg.org Connection: Keep-Alive
2024-07-25 13:18:08 UTC	834	IN	HTTP/1.1 200 OK access-control-expose-headers: Content-Disposition cache-control: private, max-age=300 content-disposition: inline; filename="README.md"; filename*=UTF-8''README.md content-length: 19742 content-type: text/plain; charset=utf-8 etag: "243aa49e5edb40b99ad1e119e19b2c51dce85a64" last-modified: Wed, 05 Jun 2024 09:59:42 GMT set-cookie: i_like_gitea=58504a77a38e2ebf; Path=/; HttpOnly; Secure; SameSite=Lax; Secure; SameSite=Lax set-cookie: _csrf=VsZgLLs2UXwoI8g4I9mAQk2Lm9U6MTcyMTkxMzQ4ODcxOTE0ODQ0NA; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax; Secure; SameSite=Lax date: Thu, 25 Jul 2024 13:18:08 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload permissions-policy: interest-cohort=() x-frame-options: sameorigin x-content-type-options: nosniff connection: close
2024-07-25 13:18:08 UTC	3438	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0d 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 2a 20 47 69 74 6c 61 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 0d 0a 23 23 23 20 e9 a2 84 e8 a7 88 0d 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0d 0a 21 5b 5d 28 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 2f 2d 2f 72 61 77 2f 6d 61 69 6e 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 22 29 0d 0a 2a 20 e9 Data Ascii: ### * https://war3tools.gitlab.io* Gitlab https://gitlab.com/war3tools/war3tools.gitlab.io### * ![](https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png "")*
2024-07-25 13:18:08 UTC	16304	IN	Data Raw: 9e 9c e8 bf 90 e8 a1 8c e5 a4 b1 e8 b4 a5 ef bc 8c e8 af b7 e4 b8 8b e8 bd bd e5 b9 b6 e5 ae 89 e8 a3 85 20 2e 6e 65 74 34 2e 36 2e 31 20 e5 be ae e8 bd af e5 ae 98 e6 96 b9 e7 a6 bb e7 ba bf e5 ae 89 e8 a3 85 e5 8c 85 ef bc 9a 20 20 0d 0a 68 74 74 70 73 3a 2f 2f 64 6f 74 6e 65 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 74 68 61 6e 6b 2d 79 6f 75 2f 6e 65 74 34 36 31 2d 6f 66 66 6c 69 6e 65 0d 0a 2a 20 42 75 67 e5 8f 8d e9 a6 88 e5 92 8c e6 84 8f e8 a7 81 e5 8f 8a e5 bb ba e8 ae ae e9 82 ae e7 ae b1 ef bc 9a 20 77 61 72 33 74 6f 6f 6c 73 40 6f 75 74 6c 6f 6f 6b 2e 63 6f 6d 20 20 0d 0a 20 20 e6 8f 8f e8 bf b0 e9 97 ae e9 a2 98 e6 97 b6 e8 af b7 e4 bd bf e7 94 a8 e6 9c 80 e6 96 b0 e7 89 88 e6 9c ac e7 9a 84 e7 a8 8b e5 ba 8f Data Ascii: .net4.6.1 https://dotnet.microsoft.com/download/thank-you/net461-offline* Bug war3tools@outlook.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49763	18.166.250.135	443	6472	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:08 UTC	106	OUT	GET /war3tools/war3tools/raw/branch/master/README.md HTTP/1.1 Host: gitea.com Connection: Keep-Alive
2024-07-25 13:18:09 UTC	692	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 13:18:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 19742 Connection: close Access-Control-Expose-Headers: Content-Disposition Cache-Control: private, max-age=300 Content-Disposition: inline; filename="README.md"; filename*=UTF-8''README.md Etag: "243aa49e5edb40b99ad1e119e19b2c51dce85a64" Last-Modified: Wed, 05 Jun 2024 09:59:06 GMT Server: Caddy Set-Cookie: i_like_gitea=d6812cb61d0da86e; Path=/; HttpOnly; Secure; SameSite=Lax Set-Cookie: _csrf=y6GTQ11WW8TrsG5-NG0f_wKzNAQ6MTcyMTkxMzQ4OTAyMjYwOTc0NA; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN
2024-07-25 13:18:09 UTC	3423	IN	Data Raw: 23 23 23 20 e5 85 b3 e4 ba 8e 0d 0a 2a 20 e4 b8 bb e9 a1 b5 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 2a 20 47 69 74 6c 61 62 ef bc 9a 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 0d 0a 0d 0a 23 23 23 20 e9 a2 84 e8 a7 88 0d 0a 2a 20 e4 b8 bb e7 95 8c e9 9d a2 20 20 0d 0a 21 5b 5d 28 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 77 61 72 33 74 6f 6f 6c 73 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 2f 2d 2f 72 61 77 2f 6d 61 69 6e 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 53 75 57 61 72 33 54 6f 6f 6c 73 2e 70 6e 67 20 22 e4 b8 bb e7 95 8c e9 9d a2 22 29 0d 0a 2a 20 e9 Data Ascii: ### * https://war3tools.gitlab.io* Gitlab https://gitlab.com/war3tools/war3tools.gitlab.io### * ![](https://gitlab.com/war3tools/war3tools.gitlab.io/-/raw/main/public/images/SuWar3Tools.png "")*
2024-07-25 13:18:09 UTC	16319	IN	Data Raw: 66 69 6c 65 73 2f 29 0d 0a 2a 20 e5 a6 82 e6 9e 9c e8 bf 90 e8 a1 8c e5 a4 b1 e8 b4 a5 ef bc 8c e8 af b7 e4 b8 8b e8 bd bd e5 b9 b6 e5 ae 89 e8 a3 85 20 2e 6e 65 74 34 2e 36 2e 31 20 e5 be ae e8 bd af e5 ae 98 e6 96 b9 e7 a6 bb e7 ba bf e5 ae 89 e8 a3 85 e5 8c 85 ef bc 9a 20 20 0d 0a 68 74 74 70 73 3a 2f 2f 64 6f 74 6e 65 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 74 68 61 6e 6b 2d 79 6f 75 2f 6e 65 74 34 36 31 2d 6f 66 66 6c 69 6e 65 0d 0a 2a 20 42 75 67 e5 8f 8d e9 a6 88 e5 92 8c e6 84 8f e8 a7 81 e5 8f 8a e5 bb ba e8 ae ae e9 82 ae e7 ae b1 ef bc 9a 20 77 61 72 33 74 6f 6f 6c 73 40 6f 75 74 6c 6f 6f 6b 2e 63 6f 6d 20 20 0d 0a 20 20 e6 8f 8f e8 bf b0 e9 97 ae e9 a2 98 e6 97 b6 e8 af b7 e4 bd bf e7 94 a8 e6 9c 80 e6 96 b0 Data Ascii: files/)* .net4.6.1 https://dotnet.microsoft.com/download/thank-you/net461-offline* Bug war3tools@outlook.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49767	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:12 UTC	730	OUT	GET /ad/header.html HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-25 13:18:12 UTC	379	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 1888 Content-Type: text/html; charset=utf-8 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:12 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:12 GMT Connection: close
2024-07-25 13:18:12 UTC	807	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 Data Ascii: <!DOCTYPE html><head> <title>3SuWar3Tools</title> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="description" content="3SuWar3Tools"> <meta name="keywords
2024-07-25 13:18:12 UTC	1081	IN	Data Raw: 36 31 5c 30 30 37 32 5c 30 30 33 33 5c 30 30 35 34 5c 30 30 36 66 5c 30 30 36 66 5c 30 30 36 63 5c 30 30 37 33 5c 61 68 74 74 70 73 3a 2f 2f 77 61 72 33 74 6f 6f 6c 73 2e 67 69 74 6c 61 62 2e 69 6f 27 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 34 34 39 35 65 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 36 72 65 6d 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 Data Ascii: 61\0072\0033\0054\006f\006f\006c\0073\ahttps://war3tools.gitlab.io'; white-space: pre; display: flex; justify-content: center; align-items: center; height: 100%; color: #34495e; font-size: 1.6rem; text-decor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49777	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:17 UTC	889	OUT	GET /ad/header.html HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
2024-07-25 13:18:17 UTC	281	IN	HTTP/1.1 304 Not Modified Cache-Control: max-age=600 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:17 UTC Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49788	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:22 UTC	889	OUT	GET /ad/header.html HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
2024-07-25 13:18:22 UTC	281	IN	HTTP/1.1 304 Not Modified Cache-Control: max-age=600 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:22 UTC Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49787	35.185.44.232	443	6472	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:22 UTC	83	OUT	GET /ad/banner.html HTTP/1.1 Host: war3tools.gitlab.io Connection: Keep-Alive
2024-07-25 13:18:22 UTC	379	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 2154 Content-Type: text/html; charset=utf-8 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:22 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:22 GMT Connection: close
2024-07-25 13:18:22 UTC	807	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 Data Ascii: <!DOCTYPE html><head> <title>3SuWar3Tools</title> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="description" content="3SuWar3Tools"> <meta name="keywords
2024-07-25 13:18:22 UTC	1347	IN	Data Raw: 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 29 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 30 70 78 3b 0a 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a Data Ascii: ing: 0; text-align: center; -webkit-font-smoothing: antialiased; -webkit-tap-highlight-color: rgba(0,0,0,0); -webkit-text-size-adjust: none; box-sizing: border-box; font-weight: bold; font-size: 40px; background-siz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49792	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:24 UTC	889	OUT	GET /ad/header.html HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
2024-07-25 13:18:24 UTC	281	IN	HTTP/1.1 304 Not Modified Cache-Control: max-age=600 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:24 UTC Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49794	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:27 UTC	889	OUT	GET /ad/header.html HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 If-None-Match: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" If-Modified-Since: Wed, 05 Jun 2024 09:43:42 GMT
2024-07-25 13:18:27 UTC	281	IN	HTTP/1.1 304 Not Modified Cache-Control: max-age=600 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:27 UTC Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49804	148.153.35.66	443	6472	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:41 UTC	86	OUT	GET /x/web-interface/zone HTTP/1.1 Host: api.bilibili.com Connection: Keep-Alive
2024-07-25 13:18:41 UTC	369	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 13:18:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 179 Connection: close Bili-Status-Code: 0 Bili-Trace-Id: 4f67f54a6266a250 Cpu_usage: 191 X-Bili-Trace-Id: 7d795b9d681cd4674f67f54a6266a250 X-Ticket-Status: 1 Access-Control-Expose-Headers: X-Cache-Webcdn X-Cache-Webcdn: BYPASS from blzone01
2024-07-25 13:18:41 UTC	179	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 30 22 2c 22 74 74 6c 22 3a 31 2c 22 64 61 74 61 22 3a 7b 22 61 64 64 72 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 69 73 70 22 3a 22 6c 65 76 65 6c 33 2e 63 6f 6d 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 30 39 30 32 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 35 2e 37 31 32 38 39 31 2c 22 7a 6f 6e 65 5f 69 64 22 3a 32 39 33 36 30 31 32 38 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 31 7d 7d Data Ascii: {"code":0,"message":"0","ttl":1,"data":{"addr":"8.46.123.33","country":"","isp":"level3.com","latitude":37.09024,"longitude":-95.712891,"zone_id":29360128,"country_code":1}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49796	35.185.44.232	443	6472	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:41 UTC	83	OUT	GET /ad/banner.html HTTP/1.1 Host: war3tools.gitlab.io Connection: Keep-Alive
2024-07-25 13:18:41 UTC	379	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 2154 Content-Type: text/html; charset=utf-8 Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:41 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:41 GMT Connection: close
2024-07-25 13:18:41 UTC	807	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e9 ad 94 e5 85 bd e4 ba 89 e9 9c b8 33 e6 94 b9 e9 94 ae 53 75 57 61 72 33 54 6f 6f 6c 73 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 Data Ascii: <!DOCTYPE html><head> <title>3SuWar3Tools</title> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="description" content="3SuWar3Tools"> <meta name="keywords
2024-07-25 13:18:41 UTC	1347	IN	Data Raw: 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 29 3b 0a 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 30 70 78 3b 0a 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a Data Ascii: ing: 0; text-align: center; -webkit-font-smoothing: antialiased; -webkit-tap-highlight-color: rgba(0,0,0,0); -webkit-text-size-adjust: none; box-sizing: border-box; font-weight: bold; font-size: 40px; background-siz

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49807	148.153.35.66	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:48 UTC	86	OUT	GET /x/web-interface/zone HTTP/1.1 Host: api.bilibili.com Connection: Keep-Alive
2024-07-25 13:18:48 UTC	369	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 13:18:48 GMT Content-Type: application/json; charset=utf-8 Content-Length: 179 Connection: close Bili-Status-Code: 0 Bili-Trace-Id: 5613c2782a66a250 Cpu_usage: 251 X-Bili-Trace-Id: 2396916fd55a5f5f5613c2782a66a250 X-Ticket-Status: 1 Access-Control-Expose-Headers: X-Cache-Webcdn X-Cache-Webcdn: BYPASS from blzone01
2024-07-25 13:18:48 UTC	179	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 30 22 2c 22 74 74 6c 22 3a 31 2c 22 64 61 74 61 22 3a 7b 22 61 64 64 72 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 69 73 70 22 3a 22 6c 65 76 65 6c 33 2e 63 6f 6d 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 30 39 30 32 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 35 2e 37 31 32 38 39 31 2c 22 7a 6f 6e 65 5f 69 64 22 3a 32 39 33 36 30 31 32 38 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 31 7d 7d Data Ascii: {"code":0,"message":"0","ttl":1,"data":{"addr":"8.46.123.33","country":"","isp":"level3.com","latitude":37.09024,"longitude":-95.712891,"zone_id":29360128,"country_code":1}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49808	148.153.35.66	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:48 UTC	86	OUT	GET /x/web-interface/zone HTTP/1.1 Host: api.bilibili.com Connection: Keep-Alive
2024-07-25 13:18:49 UTC	369	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 13:18:48 GMT Content-Type: application/json; charset=utf-8 Content-Length: 179 Connection: close Bili-Status-Code: 0 Bili-Trace-Id: 119bc082e566a250 Cpu_usage: 233 X-Bili-Trace-Id: 12aaca535b7c8d7e119bc082e566a250 X-Ticket-Status: 1 Access-Control-Expose-Headers: X-Cache-Webcdn X-Cache-Webcdn: BYPASS from blzone01
2024-07-25 13:18:49 UTC	179	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 30 22 2c 22 74 74 6c 22 3a 31 2c 22 64 61 74 61 22 3a 7b 22 61 64 64 72 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 69 73 70 22 3a 22 6c 65 76 65 6c 33 2e 63 6f 6d 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 30 39 30 32 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 35 2e 37 31 32 38 39 31 2c 22 7a 6f 6e 65 5f 69 64 22 3a 32 39 33 36 30 31 32 38 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 31 7d 7d Data Ascii: {"code":0,"message":"0","ttl":1,"data":{"addr":"8.46.123.33","country":"","isp":"level3.com","latitude":37.09024,"longitude":-95.712891,"zone_id":29360128,"country_code":1}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49811	148.153.35.66	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:50 UTC	86	OUT	GET /x/web-interface/zone HTTP/1.1 Host: api.bilibili.com Connection: Keep-Alive
2024-07-25 13:18:51 UTC	369	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 13:18:50 GMT Content-Type: application/json; charset=utf-8 Content-Length: 179 Connection: close Bili-Status-Code: 0 Bili-Trace-Id: 64e9a6f76066a250 Cpu_usage: 259 X-Bili-Trace-Id: 4c513a72c3af8c0864e9a6f76066a250 X-Ticket-Status: 1 Access-Control-Expose-Headers: X-Cache-Webcdn X-Cache-Webcdn: BYPASS from blzone01
2024-07-25 13:18:51 UTC	179	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 30 22 2c 22 74 74 6c 22 3a 31 2c 22 64 61 74 61 22 3a 7b 22 61 64 64 72 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 69 73 70 22 3a 22 6c 65 76 65 6c 33 2e 63 6f 6d 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 30 39 30 32 34 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 35 2e 37 31 32 38 39 31 2c 22 7a 6f 6e 65 5f 69 64 22 3a 32 39 33 36 30 31 32 38 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 31 7d 7d Data Ascii: {"code":0,"message":"0","ttl":1,"data":{"addr":"8.46.123.33","country":"","isp":"level3.com","latitude":37.09024,"longitude":-95.712891,"zone_id":29360128,"country_code":1}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49826	35.185.44.232	443

Timestamp	Bytes transferred	Direction	Data
2024-07-25 13:18:54 UTC	938	OUT	GET /favicon.ico HTTP/1.1 Host: war3tools.suyx.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://war3tools.suyx.net/ad/header.html Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: __gads=ID=3db76bb96bc61d49:T=1721913518:RT=1721913518:S=ALNI_MZbG8Djp3HAW8YyEyDeBQyV0rWmGw; __gpi=UID=00000eb054b56a23:T=1721913518:RT=1721913518:S=ALNI_MZJu1M0eTihEZq4YzRBr59EBWirJA; __eoi=ID=32cb7227ae4b3b68:T=1721913519:RT=1721913519:S=AA-Afjb7JbXLXpChPgWfUKZXbNdF
2024-07-25 13:18:54 UTC	368	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 16958 Content-Type: image/x-icon Etag: "bb2d341eb32d28c343cbcfdbb3d182283e3ee6df5777e8b68e5712522774e521" Expires: Thu, 25 Jul 2024 13:28:54 UTC Last-Modified: Wed, 05 Jun 2024 09:43:42 GMT Permissions-Policy: interest-cohort=() Vary: Origin Date: Thu, 25 Jul 2024 13:18:54 GMT Connection: close
2024-07-25 13:18:54 UTC	818	IN	Data Raw: 00 00 01 00 01 00 40 40 00 00 01 00 20 00 28 42 00 00 16 00 00 00 28 00 00 00 40 00 00 00 80 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@ (B(@
2024-07-25 13:18:54 UTC	2372	IN	Data Raw: 00 00 00 af 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 b7 09 0c 0f ff 16 1f 24 ff 1e 2a 30 ff 25 33 3b ff 18 23 2a ff 0c 12 16 ff 04 06 07 ff 03 04 05 ff 01 06 06 ff 04 06 07 ff 09 07 09 ff 10 0e 11 ff 03 06 0a ff 03 07 0a ff 03 09 0b ff 03 09 0a ff 06 00 05 ff 08 0a 0f ff 08 0f 13 ff 06 0f 12 ff 04 09 0b ff 04 09 0e ff 04 09 0e ff 02 07 0b ff 01 05 06 ff 07 05 07 ff 0f 0c 0e ff 08 09 0c ff 03 06 0a ff 03 08 0b ff 03 0a 0a ff 05 03 07 ff 07 06 0b ff 08 0d 12 ff 07 11 15 ff 05 0a 0c ff 04 09 0d ff 04 09 0e ff 04 09 0d ff 00 05 06 ff 05 05 07 ff 0b 09 0b ff 0d 0c 0e ff 02 06 09 ff 03 09 0b ff 03 09 0a ff 04 06 08 ff 06 01 06 ff 08 0c 12 ff 07 0f 13 ff 05 0c 0f ff 03 07 09 ff 02 03 04 ff 05 09 0a ff 16 21 27 ff 21 2f 38 ff 24 32 3c ff 1c 28 2c ff 08 0c 0d Data Ascii: P$0%3;#!'!/8$2<(,
2024-07-25 13:18:54 UTC	538	IN	Data Raw: 11 07 03 ff 11 0a 02 ff 18 16 10 ff 18 18 16 ff 28 1e 18 ff 38 2e 25 ff 3f 34 29 ff 33 2b 24 ff 39 2e 27 ff 4e 3c 2f ff 49 36 2a ff 67 4c 49 ff 3b 29 24 ff 43 32 2d ff 31 22 18 ff 2e 23 19 ff 22 1f 19 ff 1f 1a 0e ff 1c 11 04 ff 21 13 05 ff 1d 11 04 ff 1f 14 04 ff 2a 1e 0c ff 31 22 12 ff 2e 20 15 ff 29 26 22 ff 2a 2d 29 ff 32 36 34 ff 34 39 38 ff 36 32 33 ff 25 1c 1a ff 22 10 09 ff 11 05 02 ff 1f 22 19 ff 10 1a 10 ff 23 33 2e ff 27 2e 25 ff 0e 02 03 ff 14 0a 04 ff 1b 19 17 ff 1f 1d 1d ff 5b 70 78 ff 1e 2b 31 ff 0a 15 1b ff 1b 2a 31 ff 2c 3f 4b ff 07 0a 0c ff 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 38 43 70 23 35 3f ff 15 23 2a ff 02 04 05 ff 3d 4f 5b ff 4a 62 70 ff 0f 19 1d ff 15 10 0d ff 12 0b 04 ff 21 14 02 ff 21 12 03 ff 14 07 04 Data Ascii: (8.%?4)3+$9.'N</I6gLI;)$C2-1".#"!1". )&"-)264498623%""#3.'.%[px+11,?Kp&8Cp#5?#*=O[Jbp!!
2024-07-25 13:18:54 UTC	4744	IN	Data Raw: 1e ff 3a 2c 20 ff 51 41 32 ff 4a 38 2f ff 4c 3b 37 ff 47 36 24 ff 5f 45 1e ff 5b 47 38 ff 3d 2f 29 ff 27 1c 1b ff 18 15 11 ff 1a 18 16 ff 18 10 07 ff 22 13 05 ff 27 16 07 ff 2a 18 06 ff 24 14 05 ff 35 24 0f ff 38 23 11 ff 31 28 1a ff 21 1c 19 ff 19 13 11 ff 19 0f 0b ff 19 0d 07 ff 1f 12 08 ff 18 0d 05 ff 1e 12 07 ff 15 1d 0f ff 19 27 15 ff 16 1d 15 ff 05 01 01 ff 05 01 01 ff 11 05 02 ff 21 20 1f ff 1b 19 18 ff 04 06 07 ff 55 66 71 ff 4a 5a 68 ff 04 0a 15 ff 23 35 3d ff 05 08 09 ff 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 0d 12 70 11 17 1d ff 39 4e 59 ff 52 66 72 ff 41 56 60 ff 23 31 37 ff 01 01 01 ff 29 26 24 ff 1f 10 07 ff 1d 10 05 ff 18 0c 02 ff 12 07 02 ff 0f 06 02 ff 14 0f 05 ff 0f 0d 05 ff 17 10 0e ff 35 2a 21 ff 2c 20 15 ff 32 Data Ascii: :, QA2J8/L;7G6$_E[G8=/)'"'$5$8#1(!'! UfqJZh#5=pp9NYRfrAV`#17)&$5!, 2
2024-07-25 13:18:54 UTC	5930	IN	Data Raw: 20 ff 06 12 19 ff 01 10 18 ff 27 3b 44 ff 6c 89 95 ff bd e3 f7 ff 1e 24 27 ff 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 72 7e 70 69 77 81 ff 7a 8f 95 ff 1a 27 32 ff 16 2a 36 ff 14 27 32 ff 02 0b 10 ff 2f 2c 2a ff 3f 2d 22 ff 3d 27 1c ff 39 23 1a ff 3b 26 1e ff 40 2b 21 ff 4c 32 21 ff 7a 5a 46 ff 7f 61 50 ff 77 58 48 ff 65 4b 39 ff 55 3c 2f ff 45 36 28 ff 4c 39 2b ff 9c 7c 84 ff d1 ad cc ff b7 94 b8 ff ca ae c4 ff b6 92 af ff b1 86 a5 ff b1 88 9c ff ac 85 94 ff a4 7c 8c ff 8a 64 6f ff 83 5d 68 ff 61 42 4a ff 4d 33 35 ff 3e 29 24 ff 32 20 17 ff 31 25 19 ff 24 1f 1c ff 05 02 01 ff 28 23 1a ff 2a 20 12 ff 45 2f 16 ff 5a 3e 16 ff 5f 41 1a ff 42 2e 15 ff 35 25 17 ff 2b 1e 14 ff 47 2f 19 ff 5b 34 17 ff 55 2f 1a ff 59 30 18 ff 21 20 1e ff 24 Data Ascii: ';Dl$'per~piwz'26'2/,?-"='9#;&@+!L2!zZFaPwXHeK9U</E6(L9+\|\|do]haBJM35>)$2 1%$(#* E/Z>_AB.5%+G/[4U/Y0! $
2024-07-25 13:18:54 UTC	2556	IN	Data Raw: 07 08 09 b7 11 1c 22 ff 1b 31 3b ff 10 1a 1e ff 0d 17 1b ff 27 33 3a ff 2a 38 3f ff 0d 1a 1f ff 02 05 0b ff 08 0d 0f ff 10 11 14 ff 14 12 18 ff 0f 12 12 ff 0d 0f 10 ff 0b 0c 0f ff 0b 0d 10 ff 0b 11 13 ff 09 0c 0f ff 0c 13 17 ff 0f 17 1c ff 0f 16 1b ff 08 0b 0c ff 09 0d 12 ff 09 0e 11 ff 08 0d 0f ff 07 0b 0d ff 0f 0b 11 ff 0a 0d 0e ff 09 0b 0c ff 08 09 0b ff 07 08 0a ff 0b 11 12 ff 09 0c 0f ff 09 0f 12 ff 0d 15 1a ff 12 1a 20 ff 0a 0e 10 ff 09 0d 11 ff 0a 0e 12 ff 09 0e 10 ff 06 09 0b ff 0d 0b 10 ff 0d 0e 10 ff 0a 0f 0f ff 0a 0c 0e ff 0a 0a 0d ff 0c 10 11 ff 0d 12 13 ff 0e 12 14 ff 14 1a 20 ff 14 1c 21 ff 0e 11 14 ff 07 08 09 ff 03 09 0e ff 15 21 26 ff 32 42 4a ff 28 35 3c ff 07 0f 12 ff 16 24 2a ff 22 31 38 ff 10 17 1b ff 01 01 02 b7 00 00 00 00 00 00 00 Data Ascii: "1;'3:8? !!&2BJ(5<$"18

Target ID:	0
Start time:	09:16:38
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_286.exe"
Imagebase:	0x400000
File size:	4'861'966 bytes
MD5 hash:	FEFFD73DDBA802EAE61E964E78EF7E95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:17:30
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Imagebase:	0x400000
File size:	5'283'840 bytes
MD5 hash:	BF04325C66CFA445F487A5F799990189
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_EXE_Packed_DNGuard, Description: Detects executables packed with DNGuard, Source: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:17:34
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Imagebase:	0x400000
File size:	5'283'840 bytes
MD5 hash:	BF04325C66CFA445F487A5F799990189
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_EXE_Packed_DNGuard, Description: Detects executables packed with DNGuard, Source: 0000000A.00000002.2831351105.0000000009990000.00000004.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:17:41
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_286_Update.exe" "update" "LisectAVT_2403002B_286.exe"
Imagebase:	0x400000
File size:	5'283'840 bytes
MD5 hash:	F72D84B6D1683DEE10A997DEDB825D7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_EXE_Packed_DNGuard, Description: Detects executables packed with DNGuard, Source: 0000000B.00000002.2887278083.00000000099B0000.00000004.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:17:46
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002B_286.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002B_286.exe" "clear" "LisectAVT_2403002B_286_Update.exe"
Imagebase:	0x400000
File size:	5'283'840 bytes
MD5 hash:	F72D84B6D1683DEE10A997DEDB825D7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	09:18:11
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\srv33q4h\srv33q4h.cmdline"
Imagebase:	0x710000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:18:11
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:18:13
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3017.tmp" "c:\Users\user\AppData\Local\Temp\srv33q4h\CSCE64E61EBE53F4480B5C383A5A36CF7D1.TMP"
Imagebase:	0x6e0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:18:25
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zkeqnbkw\zkeqnbkw.cmdline"
Imagebase:	0x710000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:18:25
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:18:26
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6262.tmp" "c:\Users\user\AppData\Local\Temp\zkeqnbkw\CSC5F800B2BAE9D475489BCBC699BC2FE5.TMP"
Imagebase:	0x6e0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:18:28
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline"
Imagebase:	0x710000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:18:28
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:18:28
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6D8E.tmp" "c:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP"
Imagebase:	0x6e0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	33.3%
Total number of Nodes:	408
Total number of Limit Nodes:	42

Executed Functions

Function 04E0B200 Relevance: 8.7, APIs: 5, Instructions: 1217nativeshareCOMMON

Download Yara Rule

APIs

Part of subcall function 04E40B00: SetErrorMode.KERNEL32(?,?,04E0E673,00000001,?), ref: 04E40B08

NtQueryInformationProcess.NTDLL(?,?,04EAD6DC,00000001,?,?,00000001), ref: 04E0B369
WNetGetConnectionW.MPR(?,00000001,?,?,00000001,?,?,?,04EAD6DC,00000001,?,?,00000001), ref: 04E0B3FA

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ConnectionErrorInformationModeProcessQuery
String ID:
API String ID: 3711381085-0
Opcode ID: fa72fde27ff48b83146a4bf3c55031bd333c03511d0e37b625c654cf2e80a44b
Instruction ID: c2eddbe6b4623f79002e107951a64a0507de14bb55386b6638bd96e4bbc6dafe
Opcode Fuzzy Hash: fa72fde27ff48b83146a4bf3c55031bd333c03511d0e37b625c654cf2e80a44b
Instruction Fuzzy Hash: 98A26D316043409FE724EB64D890AEFB7A5FFD4308F00992DE69A572D1EB34B945CB92

Function 04E0F150 Relevance: 4.7, APIs: 3, Instructions: 208
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenFile.NTDLL ref: 04E0F1B5
NtOpenFile.NTDLL ref: 04E0F253
NtQueryDirectoryFile.NTDLL(?,?,00000000), ref: 04E0F2D0

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: File$Open$DirectoryQuery
String ID:
API String ID: 1030887729-0
Opcode ID: a0d4ee3dc64f036420b9cc9d19434f399815d81474f621f7bb3167793f97f86c
Instruction ID: d782f1a5921aa471c18fe71dfb87a74da79bf0b45ad2c347212a1479d488a59a
Opcode Fuzzy Hash: a0d4ee3dc64f036420b9cc9d19434f399815d81474f621f7bb3167793f97f86c
Instruction Fuzzy Hash: 3161B375704201ABE714EBA4D890F7F73A8AFC8718F00552CBA56AB2C1DA74FD54CB91

Function 04E7E640 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 395
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDeviceIoControlFile.NTDLL ref: 04E7E6B9

Strings

4, xrefs: 04E7E6C9

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ControlDeviceFile
String ID: 4
API String ID: 3512290074-4088798008
Opcode ID: 567134a892887c61b55ed2c05a8389f99aa1af9daebabc8ebcfacd2dcd889f4a
Instruction ID: 2eb099919436ce7eec50f14ef8785df9764516c375b4d7ff655190e7f7d8324e
Opcode Fuzzy Hash: 567134a892887c61b55ed2c05a8389f99aa1af9daebabc8ebcfacd2dcd889f4a
Instruction Fuzzy Hash: 72E16E70604301ABEB18FF74DC94D7F77A5AFC4208F40A96CE5469B1A0EE74F9498B92

Function 04E77B00 Relevance: 3.1, APIs: 2, Instructions: 60
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetSecurityObject.NTDLL(?,?,?), ref: 04E77B3C
NtSetSecurityObject.NTDLL ref: 04E77B76

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ObjectSecurity
String ID:
API String ID: 2240786066-0
Opcode ID: 39c6003f9a6f4962c4ce7683b9fd1a89417992840de0811d90ebe701745c0802
Instruction ID: 211204aff871dac6359658755e43c50c1fdfd457015d3acdf3efcdc9dee69889
Opcode Fuzzy Hash: 39c6003f9a6f4962c4ce7683b9fd1a89417992840de0811d90ebe701745c0802
Instruction Fuzzy Hash: 8D11FAB6721205AFC600FBAEED84C6B77EEFBE82527044929F515C3254C639EC058B61

Function 04E8E190 Relevance: 2.4, APIs: 1, Instructions: 902
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe2656fa84c8ef087835a70ba7e5797f216e4a1191def5ea5e87bb122a84e52
Instruction ID: 204ee05ae49685f2adb12ca2b3ebc1e44187fee9fa9aed2dcc615107252ffcea
Opcode Fuzzy Hash: ebe2656fa84c8ef087835a70ba7e5797f216e4a1191def5ea5e87bb122a84e52
Instruction Fuzzy Hash: 3E724AB1A083449FD730EF69D880A9BB7E9EFC9704F04991DE59D87251EB31B904CB92

Function 04E7CF50 Relevance: 1.8, APIs: 1, Instructions: 295
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 04E7D332

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 285508c39ebb46caeddec3787866bd04960fb80a901adca7fdef24bdbdad257b
Instruction ID: 835b03c3c5c349fe52e506d11e257bc6a5e945e8a2481b553abe9a83fcbe0537
Opcode Fuzzy Hash: 285508c39ebb46caeddec3787866bd04960fb80a901adca7fdef24bdbdad257b
Instruction Fuzzy Hash: 65B13CB16083409BD324EF54D880DAFB3E9AFC8718F04591DF68A97251EB34F945CBA2

Function 04E90D61 Relevance: 1.7, APIs: 1, Instructions: 195
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenFile.NTDLL ref: 04E90DC0

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 209a75070c8abaa29a19507b8bed34bea548c91771ece3bec8e7cafb82eac9e3
Instruction ID: 414e5c0102327053d6e9916f932aeb6fe879c8e2e8e59244ec7e5343517ce651
Opcode Fuzzy Hash: 209a75070c8abaa29a19507b8bed34bea548c91771ece3bec8e7cafb82eac9e3
Instruction Fuzzy Hash: 4C614D71A043019BDB54EF64D880F6FB7E9AF88608F44992DB589D7291EA30FD44CB92

Function 04E8DB90 Relevance: 1.7, APIs: 1, Instructions: 151
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 04E8DBE2

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8f6d356e874c46af098d62c5be9da73fffad16c525fd842f600bcdf6f8a2aa77
Instruction ID: b6f2f76ffae7470de28aec895a74697ede7e5c1155a381190e9809a08fafd0a7
Opcode Fuzzy Hash: 8f6d356e874c46af098d62c5be9da73fffad16c525fd842f600bcdf6f8a2aa77
Instruction Fuzzy Hash: 74517B71645300ABDB04FF65DC90E6BB3E5EFD5248F042A2CF58A97291EA70FD05CA92

Function 04E75880 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 04E758A1

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f009209177626179d499608bd16841c5b7a412529ccb92b9602370071b919f10
Instruction ID: 5e242e21c57313b21cdd43952556f9517f8b595ed7f4b21027e92447b9d8476a
Opcode Fuzzy Hash: f009209177626179d499608bd16841c5b7a412529ccb92b9602370071b919f10
Instruction Fuzzy Hash: 794183B5514341AFD320EF78DC84E5BB7E9EB88214F008A1DF99AC7645E774F5088BA1

Function 04E0F5C0 Relevance: 1.5, APIs: 1, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 04E0F61F

Part of subcall function 04E765A0: NtClose.NTDLL(?,?,?,04E151A1,?,?,?,?), ref: 04E765BF

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CloseFileOpen
String ID:
API String ID: 284361766-0
Opcode ID: b221757e38ba3921961b68d8ca609c319f3de5cb57e0079589f34cbb12d92d50
Instruction ID: 65363f7013931e31279948c6e07aab90a919674016e254fad677b460cced3f68
Opcode Fuzzy Hash: b221757e38ba3921961b68d8ca609c319f3de5cb57e0079589f34cbb12d92d50
Instruction Fuzzy Hash: 9A0162B1B042106BEA14E7A99C91B5B77D85F88718F004928F699E72C0DA74E9448BD6

Function 04E8DAB0 Relevance: 1.5, APIs: 1, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(00000000), ref: 04E8DACD

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 04b91c931546735e99d16fd484355705cea8a5681f123ac332cbf34ee49bf3c1
Instruction ID: a86b36dede0a8fa79b3d829c4efa8ae317eba64866601d6db8d840af894641f7
Opcode Fuzzy Hash: 04b91c931546735e99d16fd484355705cea8a5681f123ac332cbf34ee49bf3c1
Instruction Fuzzy Hash: 00016271244200AFD714EF51D885E5BB3A9FB88365F04852DFD4A87281EA34F849CB91

Function 04E5BFF0 Relevance: 1.5, APIs: 1, Instructions: 29filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 04E5C03A

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ffcd73bf1fd64879620b8d2d1f90cb484e9835dc7a528025e0226e031ae8c1a
Instruction ID: 341a202906d2b12e599494a55d9b9d8a5e713b7ccf5cbbcb8f96bd526cd5786e
Opcode Fuzzy Hash: 3ffcd73bf1fd64879620b8d2d1f90cb484e9835dc7a528025e0226e031ae8c1a
Instruction Fuzzy Hash: DFF0B2B52056009FC240DB9DC880D4BB7F9AFCC658F14871CF55CE3225D634EA518B51

Function 04E5C350 Relevance: 1.5, APIs: 1, Instructions: 29filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL ref: 04E5C39A

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 33acd8c737b7f968286e49d345cf9acbba12169bf9fbbe265e44d4b2c96dc157
Instruction ID: 954aa847dc60248fbf55083edbb538a4bfa858594ec7f25707fc06217ba890b0
Opcode Fuzzy Hash: 33acd8c737b7f968286e49d345cf9acbba12169bf9fbbe265e44d4b2c96dc157
Instruction Fuzzy Hash: 56F0BDB62056019FC240DA9DC880D5BBBF9AFCC658F148B1CF59CE3225D634EA918B62

Function 04E5C500 Relevance: 1.5, APIs: 1, Instructions: 27filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL ref: 04E5C545

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ControlFile
String ID:
API String ID: 1795486800-0
Opcode ID: 55c30c06b3f190f99acbd95a7560fd3344d57267036c6579c0b316f5f9fc98f9
Instruction ID: 26e291adaa8bec4e6f264fea88f4d7f332542a3febb96630ba7e7cf2eb08cd28
Opcode Fuzzy Hash: 55c30c06b3f190f99acbd95a7560fd3344d57267036c6579c0b316f5f9fc98f9
Instruction Fuzzy Hash: 0DF0BAB52056009FC240DB5ACA80D1BB7F9AFCCB18F108A9CB19CE3255D634FE118B62

Function 04E5C200 Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL ref: 04E5C245

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 602876eac3edc4144132c88bb673ec1085f30fb25927f83a779ddf87a7cc5b6f
Instruction ID: d0354db456c6b22dd0d7fdbb17a5107284b57698c99e60d9bc7db1c7dbd7d5ac
Opcode Fuzzy Hash: 602876eac3edc4144132c88bb673ec1085f30fb25927f83a779ddf87a7cc5b6f
Instruction Fuzzy Hash: E1F0BAB52056009FC240DB5ADA80D1BB7F9AFCCB08F108A9CB19CE3255D634FE118B62

Function 04E5C0C0 Relevance: 1.5, APIs: 1, Instructions: 25filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 04E5C100

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e2e49ea8520f8df87c1972cda128803305352f488ad19420f30d2f27f0d2408b
Instruction ID: bebbc61db7f2f63b4cdce2673d8d9d00b17dff97bdd3fa3755355086de586748
Opcode Fuzzy Hash: e2e49ea8520f8df87c1972cda128803305352f488ad19420f30d2f27f0d2408b
Instruction Fuzzy Hash: 5EF0C8B52056409FC344DA99C880D1BB7F9BFCC608F148A5CB1DCE3215D638EA118B62

Function 04E5C070 Relevance: 1.5, APIs: 1, Instructions: 25filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL ref: 04E5C0B0

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f2e961e3af4b57cd67ee6db25e1fb30f37792d58ba33d2fef47a1167317fbe48
Instruction ID: 2bbe5b4001c8e8e76328e5d1f374c1a8ee1bdac858a25d7f1fa5feae1b937962
Opcode Fuzzy Hash: f2e961e3af4b57cd67ee6db25e1fb30f37792d58ba33d2fef47a1167317fbe48
Instruction Fuzzy Hash: 63F0C8B52056409FC344DA99C880D1BB7F9BFCC608F148A5CB1DDE3215D639EA118B62

Function 04E5C1C0 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 04E5C1F6

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 1813e79689ab99f6f76f95de31e2efd0e78ff06c89431de8aaebcb21b7972556
Instruction ID: 35af5def5fda3cdc6679edf265d177dfae94a337154814f16c6c50f668e5c180
Opcode Fuzzy Hash: 1813e79689ab99f6f76f95de31e2efd0e78ff06c89431de8aaebcb21b7972556
Instruction Fuzzy Hash: 3CE002B56056019FC240DF9DCC90D4BB7F9AFDC745F10851CB559C3226D634E846CBA1

Function 04E5BA80 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL ref: 04E5BAB6

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: DuplicateObject
String ID:
API String ID: 3677547684-0
Opcode ID: 7051ef062564f1f4592074f66922cd5ea277b418d8f8db5c10c1fe60eb766633
Instruction ID: 4fb8e76cc46f10d5fbaa94fe08cc4d27c5416dd32dae3959da7f9266c34a85d0
Opcode Fuzzy Hash: 7051ef062564f1f4592074f66922cd5ea277b418d8f8db5c10c1fe60eb766633
Instruction Fuzzy Hash: A3E002B52056019FC240DF9DC880D4BB7F9AFEC744F10851CB559D3226D634E946CBA1

Function 04E5BFB0 Relevance: 1.5, APIs: 1, Instructions: 19filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 04E5BFE1

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 6b1d7b5c1d63d92112219cd2027aa3be5784a0e36f88557f40a257ece41226aa
Instruction ID: bca6341c412b7861f4fb96bec076d7e34605f3725bc319320b53d36f08e41e64
Opcode Fuzzy Hash: 6b1d7b5c1d63d92112219cd2027aa3be5784a0e36f88557f40a257ece41226aa
Instruction Fuzzy Hash: EEE002B52056029FC240DF59EA80D1BB7F9AFCCA01F108919B199E7229D634ED09DB72

Function 04E5C4C0 Relevance: 1.5, APIs: 1, Instructions: 17filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 04E5C4EC

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID:
API String ID: 634242254-0
Opcode ID: 19ea19077647725223d56b440d8980902c80b99fbb2947db3bf631f8177baa08
Instruction ID: e191da09043f28dcc5e7eda007e614b55e41ab8a929a17db75c846181f833db2
Opcode Fuzzy Hash: 19ea19077647725223d56b440d8980902c80b99fbb2947db3bf631f8177baa08
Instruction Fuzzy Hash: 00E02DB52053429BC240DF99D880D1BB3F9BFCC600F14891CB1A9D3219C734E8058B62

Function 04E5C110 Relevance: 1.5, APIs: 1, Instructions: 17filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL ref: 04E5C13C

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: 307a3653577b71bda81fad602f55da474a56ecf81cb3e1e5b3c172f0ed4b05f6
Instruction ID: 1b7210857d3a7f641a62235dce6d5b23d7037cbc524f6973386d270af9a4bc40
Opcode Fuzzy Hash: 307a3653577b71bda81fad602f55da474a56ecf81cb3e1e5b3c172f0ed4b05f6
Instruction Fuzzy Hash: 63E02DB52053429BC240DF99D880D1BB3E9BFCC604F14891CB1A9D3229C734E8158B62

Function 04E765A0 Relevance: 1.5, APIs: 1, Instructions: 15nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,?,04E151A1,?,?,?,?), ref: 04E765BF

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6425ce7476893d03a982bba55e83f2574365ff8751d8f8adb7d12644c4bfbad5
Instruction ID: f69376ca1dc3c5faf6931bfd8bd1a694f16b5270a93c3c651eb5b94094d55857
Opcode Fuzzy Hash: 6425ce7476893d03a982bba55e83f2574365ff8751d8f8adb7d12644c4bfbad5
Instruction Fuzzy Hash: 91D017316041028BCA00CB75D880E5673E5FB68701B0485A0E008C7254C638F846CB01

Function 04E5BCF0 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL ref: 04E5BD12

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ef100438c178c3f3a85ef328aacebc9509c362afdf99b660359fb09ef11c7f29
Instruction ID: 21aba2488e48e9c4cfd5f8905abde25ca00955d9fa9762506b9774a0db0b64c1
Opcode Fuzzy Hash: ef100438c178c3f3a85ef328aacebc9509c362afdf99b660359fb09ef11c7f29
Instruction Fuzzy Hash: 11D09275205201AFC200EB99C880E0BB7F9EFC8304F10C519B5A8C7229C634E841CB61

Function 04E5C5B0 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtSetSecurityObject.NTDLL ref: 04E5C5D2

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ObjectSecurity
String ID:
API String ID: 2240786066-0
Opcode ID: c328f95a4b945f8a5b3dc80099c40e6d938c7a71e5b0bdd9451abdc8fbcaaf72
Instruction ID: 63c5dcf6a6f3bc446fd82d12d77fa092c90bc758422330287a9b659245e2339c
Opcode Fuzzy Hash: c328f95a4b945f8a5b3dc80099c40e6d938c7a71e5b0bdd9451abdc8fbcaaf72
Instruction Fuzzy Hash: 77D09275205201AFC200DB99D880E0BB7E9FFD8304F10C518B5A8C3229CA34E841CB51

Function 04E5C190 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL ref: 04E5C1B2

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: OpenSection
String ID:
API String ID: 1950954290-0
Opcode ID: 622b8e53effc973f96025228f2f4ebd2773fbcdc0bab9f4a754eedbee053c625
Instruction ID: 154c6fdf059f237a2659234a9a270aad8cd58b2a13091d6e4077133eba1ddf2e
Opcode Fuzzy Hash: 622b8e53effc973f96025228f2f4ebd2773fbcdc0bab9f4a754eedbee053c625
Instruction Fuzzy Hash: FED09275205201AFC200DB99C884E0BB7E9EFC8304F10C518B5ACC3229CA34E840CB61

Function 04E5C290 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 04E5C2AD

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: b71e665c29aa92648ba14ce69dd3bb7c24daa26491a644d8150dfcea87c70916
Instruction ID: f81da7fb405fabb1325e59494199275df5e99d6dc77eb1c672e39352957fedd5
Opcode Fuzzy Hash: b71e665c29aa92648ba14ce69dd3bb7c24daa26491a644d8150dfcea87c70916
Instruction Fuzzy Hash: 5FD0CA74201200AFC200EB29D980E1BB7A9BFC8300B10C628A09893269CA34EC00DB51

Function 04E5C3A0 Relevance: 1.5, APIs: 1, Instructions: 11filenativeCOMMON

Download Yara Rule

APIs

NtQueryAttributesFile.NTDLL ref: 04E5C3BD

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: AttributesFileQuery
String ID:
API String ID: 2106648053-0
Opcode ID: 7f2c6fb5f539269ef8a4625c7246bcef280848b1e641ce3f070ad457e62b09a2
Instruction ID: c4707302a07f4e033a961c9ec9986387f44235f2f58af73e8c90fbdfccc2cd7c
Opcode Fuzzy Hash: 7f2c6fb5f539269ef8a4625c7246bcef280848b1e641ce3f070ad457e62b09a2
Instruction Fuzzy Hash: 5DD0CA78206200ABC200EB29C980E1BB7A9AFC8300B10C558A09883229CA38EC019A11

Function 04E5BA50 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 04E5BA6C

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d39c9577dc767e0f8e4aa055d20d9b1426c21fd989f9e6ff95ca7252a6528d02
Instruction ID: f71af8c5a78a5ddaace39d58da221e13fab4263544ab722446f23dc1b6d19c10
Opcode Fuzzy Hash: d39c9577dc767e0f8e4aa055d20d9b1426c21fd989f9e6ff95ca7252a6528d02
Instruction Fuzzy Hash: 5CC08C707052008BC200EB68CC84E0A73E5FFEC340F008028A05CC730ACA38FC01CE00

Function 04E477C0 Relevance: 11.2, APIs: 7, Instructions: 690
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 04E4786C
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 04E478E4
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 04E47989
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00210CF0), ref: 04E47AD5
CreateFileMappingW.KERNELBASE(000000FF,04ED8968,00000004,00000000,00100000,?,00000006,00000000,00000000,00210CF0), ref: 04E47BF5
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00100000), ref: 04E47C3F

Part of subcall function 04E45FC0: GetFileAttributesW.KERNEL32(?), ref: 04E45FC5

CreateFileMappingW.KERNELBASE(000000FF,04ED8968,00000004,00000000,00210CF0,?), ref: 04E47A5B

Part of subcall function 04E765A0: NtClose.NTDLL(?,?,?,04E151A1,?,?,?,?), ref: 04E765BF

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CreateFile$Mutex$MappingView$AttributesClose
String ID:
API String ID: 1244313601-0
Opcode ID: 3f5c190e509b8a0298f4cdc83e99fa2c7011543d471f332d22ad724cd605f9d2
Instruction ID: 583ec48f8f65aea1afea48e03f5a7dbfb0c23905c289063759befefcf984fb37
Opcode Fuzzy Hash: 3f5c190e509b8a0298f4cdc83e99fa2c7011543d471f332d22ad724cd605f9d2
Instruction Fuzzy Hash: 833274B16043005BE324EB64DC81FABB3A9EFD4708F145A1DF59697280EB74F915CBA2

Function 0043ADFD Relevance: 9.1, APIs: 6, Instructions: 107
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043F81D: TlsGetValue.KERNEL32(?,0043AE02), ref: 0043F824
Part of subcall function 0043F81D: TlsSetValue.KERNEL32(00000000,0043AE02), ref: 0043F845

Part of subcall function 0043F802: TlsGetValue.KERNEL32(?,0043AE0D,00000000), ref: 0043F80C

GetLastError.KERNEL32(00000000,?,00000000), ref: 0043AE24
ExitThread.KERNEL32 ref: 0043AE2B
CreateThread.KERNEL32(00000000,?,0043ADFD,00000000,00000004,00000000), ref: 0043AEE3
ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 0043AEF3
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 0043AEFE
__dosmaperr.LIBCMT ref: 0043AF16

Memory Dump Source

Source File: 00000000.00000002.2698519737.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2698453549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698654394.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698728259.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.000000000046D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000570000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000576000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000583000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2699884196.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700460692.00000000005A3000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.000000000075D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ThreadValue$ErrorLast$CreateExitResume__dosmaperr
String ID:
API String ID: 1421997792-0
Opcode ID: 95dbf250f0f650d72b0557ce41af9bff93a54a02cca207d85b1c51c4d98ce115
Instruction ID: d9e92146fc605ecf92f8e0cb711c6202a8853bc182fc8bffc2600e95974633b1
Opcode Fuzzy Hash: 95dbf250f0f650d72b0557ce41af9bff93a54a02cca207d85b1c51c4d98ce115
Instruction Fuzzy Hash: 0D3120B1841300ABDB187F729D4A95F7BA4EF4C32DF20563FF554822A2DB78C8048A5E

Function 04E44940 Relevance: 7.7, APIs: 5, Instructions: 194
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(000000FF,04ED8968,00000004,00000000,00000004,?), ref: 04E44999
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000004), ref: 04E449E1
CreateFileMappingW.KERNELBASE(000000FF,04ED8968,00000004,00000000,00000018,?), ref: 04E44A2C
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,00000018), ref: 04E44A4E

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: e1d93ae6cc64343c077d8b2bb3bc557795d2c820ce87db94b6a6216c8c140615
Instruction ID: 34b5bcdf43c7b10d4aa9fb19084a05b580b044781b34a1141874fbe3ca34f065
Opcode Fuzzy Hash: e1d93ae6cc64343c077d8b2bb3bc557795d2c820ce87db94b6a6216c8c140615
Instruction Fuzzy Hash: 9A51D5B16003046BD360EF69EC41F6BB7EDFB84758F040A2DF29592281EA71F4198BA5

Function 0043ADBC Relevance: 4.5, APIs: 3, Instructions: 32
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043F9DB: __amsg_exit.LIBCMT ref: 0043F9E9

CloseHandle.KERNEL32(?), ref: 0043ADA6
__freeptd.LIBCMT ref: 0043ADAD
ExitThread.KERNEL32 ref: 0043ADB5

Part of subcall function 0043FD90: __FindPESection.LIBCMT ref: 0043FDE9

Memory Dump Source

Source File: 00000000.00000002.2698519737.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2698453549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698654394.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698728259.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.000000000046D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000570000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000576000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000583000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2699884196.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700460692.00000000005A3000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.000000000075D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CloseExitFindHandleSectionThread__amsg_exit__freeptd
String ID:
API String ID: 1262231458-0
Opcode ID: b23d0af45d41ee54e17b61858cfc5b22db630a960199009171090f466a26fffd
Instruction ID: 087f8f893f9146e22835cab90ed0cf15e536a4f6782d65b4837159175cf75cb2
Opcode Fuzzy Hash: b23d0af45d41ee54e17b61858cfc5b22db630a960199009171090f466a26fffd
Instruction Fuzzy Hash: BAF0B431941601EBD7156BE49A0DB5E37115F0D727F14112BF141959E2CBACC815865E

Function 04DD4920 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,00000001,?), ref: 04DD4A6B

Strings

, xrefs: 04DD4A5C

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 0d178036a5ef255de51ca21ecc9b7106da5a3c7cd8be8b6f7612a1d285532243
Instruction ID: 323cb04aa8ffe2663ffd35ffc9676b0a08370961d3e0063007b7f9e133934756
Opcode Fuzzy Hash: 0d178036a5ef255de51ca21ecc9b7106da5a3c7cd8be8b6f7612a1d285532243
Instruction Fuzzy Hash: FA4103726043118FE314CF1AC840B6AB7E5FF85308F04862DEA959B395E776F919CB91

Function 04E48090 Relevance: 3.4, APIs: 2, Instructions: 413
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(000000FF,04ED8968,00000004,00000000,?,?), ref: 04E482C2
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?), ref: 04E482E3

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: 3da115d0930b72cba64d4b76837a05dcc6ea86a2d30d3b2a9b6f713eba1d0a6c
Instruction ID: a95e3c08bad05d83c595b36e2ebc566dded420af7277fc25e622817a85ff5e43
Opcode Fuzzy Hash: 3da115d0930b72cba64d4b76837a05dcc6ea86a2d30d3b2a9b6f713eba1d0a6c
Instruction Fuzzy Hash: E6E17EB5A043009FD724DF25D884B6BB7E5FBC8318F049A29F95997280E775F805CBA2

Function 04E60EF0 Relevance: 3.1, APIs: 2, Instructions: 111
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?,04E610EF,?,?), ref: 04E60F5A
CreateMutexW.KERNEL32(00000000,00000001,00000000,?,?,?,04E610EF,?,?), ref: 04E60FCC

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: AllocCreateMutexVirtual
String ID:
API String ID: 3913005568-0
Opcode ID: 8a73bd10ca8830ed936bda83617b6e37c7a497ee13b27cb75ed1af3baec0934f
Instruction ID: 6dceea9918ec5fbe676f9fcdde57390ab5b8d3ea49f4cb996701a0f53df5207a
Opcode Fuzzy Hash: 8a73bd10ca8830ed936bda83617b6e37c7a497ee13b27cb75ed1af3baec0934f
Instruction Fuzzy Hash: 414126B19007018FC360DF2AD880916FBF6FF98364F549A2EE99A83B91D770F9058B51

Function 04E15E80 Relevance: 1.6, APIs: 1, Instructions: 108threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00045E60,?,00000000,?), ref: 04E15F77

Part of subcall function 04E765A0: NtClose.NTDLL(?,?,?,04E151A1,?,?,?,?), ref: 04E765BF

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CloseCreateThread
String ID:
API String ID: 562768112-0
Opcode ID: bdd5e91f60945e2642bc808299a0b493e3b8a25fe176763d51f47f4f5bf6e978
Instruction ID: 516257b3693290ca4a8912d77ea72f3abce4e7bb7c3e12332aca3492b89ceb05
Opcode Fuzzy Hash: bdd5e91f60945e2642bc808299a0b493e3b8a25fe176763d51f47f4f5bf6e978
Instruction Fuzzy Hash: 0741C2B0904B019F8320CF2AD980817FBF9FFD9724B505A1EE49AC3A60E374F5458BA5

Function 04E609C0 Relevance: 1.5, APIs: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_000908D0,?,00000000,?), ref: 04E60A06

Part of subcall function 04E765A0: NtClose.NTDLL(?,?,?,04E151A1,?,?,?,?), ref: 04E765BF

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CloseCreateThread
String ID:
API String ID: 562768112-0
Opcode ID: 640f8da2a1c498c254ecdab630d894c5f08b15fb6a3c2223951232f16cc69fe8
Instruction ID: 9725bcf43f01049f1c4a0896004b34613b552133f32ea4689a1adbe513c95550
Opcode Fuzzy Hash: 640f8da2a1c498c254ecdab630d894c5f08b15fb6a3c2223951232f16cc69fe8
Instruction Fuzzy Hash: 0001867179071066F630DF359C45F1776E9DB407B8F241B29F646D65C0E670F40587A1

Function 04E441E0 Relevance: 1.5, APIs: 1, Instructions: 41threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_000741D0,?,00000000,?), ref: 04E441F7

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: c03bba12532e1ec81d312236267b86596d9649a40cf15fc14c06e1a043692f89
Instruction ID: be31c05494b040e7b09c5ea8564856c4fb2216dbf541909188581e0c19f8a124
Opcode Fuzzy Hash: c03bba12532e1ec81d312236267b86596d9649a40cf15fc14c06e1a043692f89
Instruction Fuzzy Hash: 68F06936200211AFC224DF99EC44F9BB7F9EFC8710F00881DF68987290D674B809CBA5

Function 13B194EA Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

], xrefs: 13B195DE

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-636209891
Opcode ID: 7f5871db1c06543f2e016d8a255d1c853c7a128f22bd28e276128872426d110a
Instruction ID: 88e6b5dd96296a8b26b6e8a4ae564fd8c964319f29c296921ee2d63315994283
Opcode Fuzzy Hash: 7f5871db1c06543f2e016d8a255d1c853c7a128f22bd28e276128872426d110a
Instruction Fuzzy Hash: 5BB14970A14385CFEB20CF54E894719B7E6EF81324F288139D9159F289F771AC92CBA1

Function 13B194EA Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

], xrefs: 13B195DE

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-636209891
Opcode ID: 7f5871db1c06543f2e016d8a255d1c853c7a128f22bd28e276128872426d110a
Instruction ID: 88e6b5dd96296a8b26b6e8a4ae564fd8c964319f29c296921ee2d63315994283
Opcode Fuzzy Hash: 7f5871db1c06543f2e016d8a255d1c853c7a128f22bd28e276128872426d110a
Instruction Fuzzy Hash: 5BB14970A14385CFEB20CF54E894719B7E6EF81324F288139D9159F289F771AC92CBA1

Function 13B194EA Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

], xrefs: 13B195DE

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-636209891
Opcode ID: e95aa9d6e8cca9951acf268c8ae5f47d4671ff1e77e603c139733e527e33259e
Instruction ID: 88e6b5dd96296a8b26b6e8a4ae564fd8c964319f29c296921ee2d63315994283
Opcode Fuzzy Hash: e95aa9d6e8cca9951acf268c8ae5f47d4671ff1e77e603c139733e527e33259e
Instruction Fuzzy Hash: 5BB14970A14385CFEB20CF54E894719B7E6EF81324F288139D9159F289F771AC92CBA1

Function 13B194EA Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

], xrefs: 13B195DE

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-636209891
Opcode ID: e95aa9d6e8cca9951acf268c8ae5f47d4671ff1e77e603c139733e527e33259e
Instruction ID: 88e6b5dd96296a8b26b6e8a4ae564fd8c964319f29c296921ee2d63315994283
Opcode Fuzzy Hash: e95aa9d6e8cca9951acf268c8ae5f47d4671ff1e77e603c139733e527e33259e
Instruction Fuzzy Hash: 5BB14970A14385CFEB20CF54E894719B7E6EF81324F288139D9159F289F771AC92CBA1

Function 04E61440 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 04E61457

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 985b6dc2faaa9e36ab811cf5637d72a52b8d63d0d22bcb32fc32dc53f1b209da
Instruction ID: 6c666e621caa4c307f4b8d55a631291d70d9c6899c81fcb09526ab4a92ca5767
Opcode Fuzzy Hash: 985b6dc2faaa9e36ab811cf5637d72a52b8d63d0d22bcb32fc32dc53f1b209da
Instruction Fuzzy Hash: A4F09AB5D81320ABDB106F72FC4DF9A3A6AFB00746F415024F926D7248D6BD6C918B91

Function 04E60E10 Relevance: 1.5, APIs: 1, Instructions: 26threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,Function_00090CF0,00000000,00000000,00000000), ref: 04E60E48

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: ff7560c876792e2644629b9672526107a5e3f6ccb2d61e0f3ca7917a20cc465b
Instruction ID: ca9e58627fc472287d26f05886de33249a4c540c01a7f64a9d6d2ad8bd172015
Opcode Fuzzy Hash: ff7560c876792e2644629b9672526107a5e3f6ccb2d61e0f3ca7917a20cc465b
Instruction Fuzzy Hash: 90E09272681331EFD2349B26AC04F47FFE4EF94B50F11992AE94697280C6B4B840C7A5

Function 04E60CB0 Relevance: 1.5, APIs: 1, Instructions: 24threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,Function_00090950,00000000,00000000,00000000), ref: 04E60CE1

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: e70e9aa152e9233e68e072bcf62740507ba410e73d0b75e0f899d94b9a92cc11
Instruction ID: 1e95fb08a2ea4923a96c95174b09687d9e503ff22194b846fa1d7300fe1d5566
Opcode Fuzzy Hash: e70e9aa152e9233e68e072bcf62740507ba410e73d0b75e0f899d94b9a92cc11
Instruction Fuzzy Hash: 57E08631A82231B7D2305B66BC09F47BEA4EB84B91F015555B942B7281C6B4B841C7E1

Function 04E5CA40 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 04E5CA69

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 8119e9a6c2ff1627a5c7434af7c00cb9f276138431a09492fdf497d6ca018873
Instruction ID: 29ab952013d55ceaf9f77b8a379bdc02ddf39be1a2580bff620bd67dee2d8941
Opcode Fuzzy Hash: 8119e9a6c2ff1627a5c7434af7c00cb9f276138431a09492fdf497d6ca018873
Instruction Fuzzy Hash: D0E0DFB050071043E220DF289808693BAD4AB02728B24AA1DF9EBD32D6C330F840C382

Function 04E75810 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,04DD49A6,?,?,00000004), ref: 04E7582C

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 219b6989e24e3bc9185c904ed27090141b6ec60f709914e602fca9d97034f2b7
Instruction ID: ec6de36e2cc3ff1360e6e54567ee982876e1cb022da6fded03d1644129916fb5
Opcode Fuzzy Hash: 219b6989e24e3bc9185c904ed27090141b6ec60f709914e602fca9d97034f2b7
Instruction Fuzzy Hash: 01E0E2B2604711AF8364CF58E880D57B7F9EB88B10B00C91EB19DC3604D270EC458BA1

Function 04E75840 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,00000000,?,04DD49B9), ref: 04E75856

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 58854aead879146d170662784ad05187d108c1993a19818c050f94f042036952
Instruction ID: 4fbd21feb7649aebbf80d3b2951fb726cc6fa93ad0c99c77ab5aa7c66ec01b49
Opcode Fuzzy Hash: 58854aead879146d170662784ad05187d108c1993a19818c050f94f042036952
Instruction Fuzzy Hash: 82D0C9B0110104EFD358CB14DC84EA677ADEB8832AF24859CE0498B641C737E847CB60

Function 04E40B00 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,?,04E0E673,00000001,?), ref: 04E40B08

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 302f4ff32a8f2f5fbaf471065b514b80abed531cc555dc6eba61a44f1e394a84
Instruction ID: bab62ca46fe3779aff862c70d550462b57ab5403051826148a551f7138d481d3
Opcode Fuzzy Hash: 302f4ff32a8f2f5fbaf471065b514b80abed531cc555dc6eba61a44f1e394a84
Instruction Fuzzy Hash: 50C09B766052205FC3A0DF5D9808D87BBD4DB686617014929B588C3204C534DC50C790

Function 04E45FC0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?), ref: 04E45FC5

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 05b7b2e8daf6dbe7bc0f0c3082a61aeb3038ec0138ce19f69aa70979c59ea7c7
Instruction ID: e19174e196fdb79be1f67f97e3f3a9285bbe6b2300be9e533bc4ff2de413546a
Opcode Fuzzy Hash: 05b7b2e8daf6dbe7bc0f0c3082a61aeb3038ec0138ce19f69aa70979c59ea7c7
Instruction Fuzzy Hash: 49B012BA7101005BCB0847789D8D94E32949F58A327200B1CB033C24C0D734DC60AB11

Function 04E40B20 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,04E0E753), ref: 04E40B23

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b0d564087c6d4ede3b9ef27ecaf43e180e1bd9006efc7137a49d7f931f0ae40b
Instruction ID: 57623f36306674d852a31b942f20b40bbcbe87b18991f44af42a805769433e1f
Opcode Fuzzy Hash: b0d564087c6d4ede3b9ef27ecaf43e180e1bd9006efc7137a49d7f931f0ae40b
Instruction Fuzzy Hash: 84A00274D002009BCE40DBB5D94CD453769EB553067100594B011C6414C639A850CA10

Function 04E61040 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04E61055

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3685e3216c7c3649bf0bb02326a695341ab8f99914c55366e791fb871c9e6afa
Instruction ID: 1b55f10b6f8191a48de6f4c79bffbe926859fbea547ef0accb1dd0016030cf4f
Opcode Fuzzy Hash: 3685e3216c7c3649bf0bb02326a695341ab8f99914c55366e791fb871c9e6afa
Instruction Fuzzy Hash: CA012974640B118BDBB0DF79CA84B53B3E8AF04768F141A0CA556C7A90DB74F8458B50

Function 13B2B39C Relevance: .9, Instructions: 897COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601297789.0000000013B2B000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B2B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a6ea5ed11b6a4ef16fe64573f900ecf397f5ad90208a0a5c41d8a4d8b78116
Instruction ID: 30659999c989e69bec58511716707cbdd62d4b6dfea2f22e5cb29de7a9638488
Opcode Fuzzy Hash: 04a6ea5ed11b6a4ef16fe64573f900ecf397f5ad90208a0a5c41d8a4d8b78116
Instruction Fuzzy Hash: EE72D170A04251CFDB14CF94C9D0E69BBB5FF88710F988669E94A6B385EB70BC81CB51

Function 13B2B39C Relevance: .9, Instructions: 897COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601297789.0000000013B2B000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B29000, based on PE: false

Associated: 00000000.00000003.2601263300.0000000013B29000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29132b17a959bf0285d6690e0854f2e25bcdda2bb9e1ea78b4d013c7bf88f686
Instruction ID: 30659999c989e69bec58511716707cbdd62d4b6dfea2f22e5cb29de7a9638488
Opcode Fuzzy Hash: 29132b17a959bf0285d6690e0854f2e25bcdda2bb9e1ea78b4d013c7bf88f686
Instruction Fuzzy Hash: EE72D170A04251CFDB14CF94C9D0E69BBB5FF88710F988669E94A6B385EB70BC81CB51

Function 10D21011 Relevance: .9, Instructions: 888COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92cb11717b82a72b6d889fd8df2f3cc350da4c120b0267804a582ddfb159418d
Instruction ID: 940deaf1dd7c8a9987c1fc1d6e62523fc42458d9e6e8c510b9398f461d0826c9
Opcode Fuzzy Hash: 92cb11717b82a72b6d889fd8df2f3cc350da4c120b0267804a582ddfb159418d
Instruction Fuzzy Hash: 7982BE7CE04255CFDB20CF64E890B49BBB1FB54358FA9C199D958AB381C7719C82CBA1

Function 13B220CC Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601537195.0000000013B22000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964df5ad7093e8583e5b59a66686ddb33bd4957f00d1358a4cd0967b43d14e36
Instruction ID: f7e19f035bf439232d73f6777fc40451e3fcc4829fb2f00aa92a7f63a45f0cbe
Opcode Fuzzy Hash: 964df5ad7093e8583e5b59a66686ddb33bd4957f00d1358a4cd0967b43d14e36
Instruction Fuzzy Hash: 11323571A00345EFD750CF54D890B6ABBA5FF05704F948269E619EF2C1E7B1B881CBA1

Function 13B198CB Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365b717df13fe654975350c58c123d3f9356bba31368b8311fa96f669ad0f239
Instruction ID: 0fcc6ccfc03d156462095345562428d6a00eb6d3f8c3fd699368ba537bdc6505
Opcode Fuzzy Hash: 365b717df13fe654975350c58c123d3f9356bba31368b8311fa96f669ad0f239
Instruction Fuzzy Hash: D4E1C370A0434ADFEB14CF54E8A075EB7E5FF85750F244129E516AF244F730A892CB91

Function 13B198CB Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365b717df13fe654975350c58c123d3f9356bba31368b8311fa96f669ad0f239
Instruction ID: 0fcc6ccfc03d156462095345562428d6a00eb6d3f8c3fd699368ba537bdc6505
Opcode Fuzzy Hash: 365b717df13fe654975350c58c123d3f9356bba31368b8311fa96f669ad0f239
Instruction Fuzzy Hash: D4E1C370A0434ADFEB14CF54E8A075EB7E5FF85750F244129E516AF244F730A892CB91

Function 13B198CB Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55125a105240a8324d43f6d87f565ad501c9f19b4076bcc45d8deafbbbb63a5
Instruction ID: 0fcc6ccfc03d156462095345562428d6a00eb6d3f8c3fd699368ba537bdc6505
Opcode Fuzzy Hash: e55125a105240a8324d43f6d87f565ad501c9f19b4076bcc45d8deafbbbb63a5
Instruction Fuzzy Hash: D4E1C370A0434ADFEB14CF54E8A075EB7E5FF85750F244129E516AF244F730A892CB91

Function 13B198CB Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55125a105240a8324d43f6d87f565ad501c9f19b4076bcc45d8deafbbbb63a5
Instruction ID: 0fcc6ccfc03d156462095345562428d6a00eb6d3f8c3fd699368ba537bdc6505
Opcode Fuzzy Hash: e55125a105240a8324d43f6d87f565ad501c9f19b4076bcc45d8deafbbbb63a5
Instruction Fuzzy Hash: D4E1C370A0434ADFEB14CF54E8A075EB7E5FF85750F244129E516AF244F730A892CB91

Function 13B1F9A6 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601591816.0000000013B1F000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5332b5f0dfc14f82a62e2d163cd36b3d18c031279109a8a70215eb7c1d7d44d
Instruction ID: 8b8f9030dbc81c94cd0a3e5620e35813a9d5c089c5cae54d49bff31de42f4eb8
Opcode Fuzzy Hash: d5332b5f0dfc14f82a62e2d163cd36b3d18c031279109a8a70215eb7c1d7d44d
Instruction Fuzzy Hash: 5AB10A71A04706DFCB04CF54E890AAEB7B5FF59750F24872DE616AF280E7309856CBA1

Function 13B1C0DF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3568dc1d6bfc52f91803435fc038954b4d9df8d28b709c410e2996b406a39b39
Instruction ID: 69afa672edf42b4426bd747fe86c22ff2209a725d29c49a62835025d7d477b32
Opcode Fuzzy Hash: 3568dc1d6bfc52f91803435fc038954b4d9df8d28b709c410e2996b406a39b39
Instruction Fuzzy Hash: CA413570A48345DFEF11CFA8EC50B5DB7A4EB45B50F28813AE505EF284E7B058A1CBA1

Function 13B1C0DF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3568dc1d6bfc52f91803435fc038954b4d9df8d28b709c410e2996b406a39b39
Instruction ID: 69afa672edf42b4426bd747fe86c22ff2209a725d29c49a62835025d7d477b32
Opcode Fuzzy Hash: 3568dc1d6bfc52f91803435fc038954b4d9df8d28b709c410e2996b406a39b39
Instruction Fuzzy Hash: CA413570A48345DFEF11CFA8EC50B5DB7A4EB45B50F28813AE505EF284E7B058A1CBA1

Function 13B1C0DF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction ID: 69afa672edf42b4426bd747fe86c22ff2209a725d29c49a62835025d7d477b32
Opcode Fuzzy Hash: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction Fuzzy Hash: CA413570A48345DFEF11CFA8EC50B5DB7A4EB45B50F28813AE505EF284E7B058A1CBA1

Function 13B1C0DF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction ID: 69afa672edf42b4426bd747fe86c22ff2209a725d29c49a62835025d7d477b32
Opcode Fuzzy Hash: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction Fuzzy Hash: CA413570A48345DFEF11CFA8EC50B5DB7A4EB45B50F28813AE505EF284E7B058A1CBA1

Function 13B1C0DF Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction ID: 69afa672edf42b4426bd747fe86c22ff2209a725d29c49a62835025d7d477b32
Opcode Fuzzy Hash: 3cc98dc3263863927304cd19cedd817243355e2a33a8bbebaf710c765d02e346
Instruction Fuzzy Hash: CA413570A48345DFEF11CFA8EC50B5DB7A4EB45B50F28813AE505EF284E7B058A1CBA1

Function 13B173FE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c01bc438f0c1fc59fd400484fb827bb4b82be34fe45df55d090d2b61af5f20
Instruction ID: 1518794a3a2037ed78babf64e320ab0ad8f2bb9594d06fe10ffae41e23ee65fb
Opcode Fuzzy Hash: 98c01bc438f0c1fc59fd400484fb827bb4b82be34fe45df55d090d2b61af5f20
Instruction Fuzzy Hash: 9E415D71A542919ED7148229BC67B6A6F5ADB80368F1C0579F843EF2C1FBD19C90C3B1

Function 13B173FE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c01bc438f0c1fc59fd400484fb827bb4b82be34fe45df55d090d2b61af5f20
Instruction ID: 1518794a3a2037ed78babf64e320ab0ad8f2bb9594d06fe10ffae41e23ee65fb
Opcode Fuzzy Hash: 98c01bc438f0c1fc59fd400484fb827bb4b82be34fe45df55d090d2b61af5f20
Instruction Fuzzy Hash: 9E415D71A542919ED7148229BC67B6A6F5ADB80368F1C0579F843EF2C1FBD19C90C3B1

Function 13B173FE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25821f7ff02c290679f06ae08d293e85ddcf2bde3bd99019b9126ee8bc0fca69
Instruction ID: 1518794a3a2037ed78babf64e320ab0ad8f2bb9594d06fe10ffae41e23ee65fb
Opcode Fuzzy Hash: 25821f7ff02c290679f06ae08d293e85ddcf2bde3bd99019b9126ee8bc0fca69
Instruction Fuzzy Hash: 9E415D71A542919ED7148229BC67B6A6F5ADB80368F1C0579F843EF2C1FBD19C90C3B1

Function 13B173FE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25821f7ff02c290679f06ae08d293e85ddcf2bde3bd99019b9126ee8bc0fca69
Instruction ID: 1518794a3a2037ed78babf64e320ab0ad8f2bb9594d06fe10ffae41e23ee65fb
Opcode Fuzzy Hash: 25821f7ff02c290679f06ae08d293e85ddcf2bde3bd99019b9126ee8bc0fca69
Instruction Fuzzy Hash: 9E415D71A542919ED7148229BC67B6A6F5ADB80368F1C0579F843EF2C1FBD19C90C3B1

Function 13B25B10 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601479467.0000000013B25000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B25000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b998e626f1133c465e5fdba98cecafb05674e0db8a66d9d84ab286982a0a3a1f
Instruction ID: 33718dea73f100e2a4cd64c0bcffcc4596fab805f0446dbdbb5e47925a456cc4
Opcode Fuzzy Hash: b998e626f1133c465e5fdba98cecafb05674e0db8a66d9d84ab286982a0a3a1f
Instruction Fuzzy Hash: 7A31D670608201EFD710CF58DC84EAAF7E4EF84760F95855AF9899B291DB70B841CB91

Function 13B1C0EE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction ID: fd7db1d52ce405cb5f962bf6ab00c364f5b735a0017ae098ef9f0c9b07995bd8
Opcode Fuzzy Hash: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction Fuzzy Hash: 6F210371F883159BDB108E98DC4079DF7E5EF85750F18813AE949AB358D7B09C21CB81

Function 13B1C0EE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction ID: fd7db1d52ce405cb5f962bf6ab00c364f5b735a0017ae098ef9f0c9b07995bd8
Opcode Fuzzy Hash: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction Fuzzy Hash: 6F210371F883159BDB108E98DC4079DF7E5EF85750F18813AE949AB358D7B09C21CB81

Function 13B1C0EE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction ID: fd7db1d52ce405cb5f962bf6ab00c364f5b735a0017ae098ef9f0c9b07995bd8
Opcode Fuzzy Hash: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction Fuzzy Hash: 6F210371F883159BDB108E98DC4079DF7E5EF85750F18813AE949AB358D7B09C21CB81

Function 13B1C0EE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction ID: fd7db1d52ce405cb5f962bf6ab00c364f5b735a0017ae098ef9f0c9b07995bd8
Opcode Fuzzy Hash: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction Fuzzy Hash: 6F210371F883159BDB108E98DC4079DF7E5EF85750F18813AE949AB358D7B09C21CB81

Function 13B1C0EE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction ID: fd7db1d52ce405cb5f962bf6ab00c364f5b735a0017ae098ef9f0c9b07995bd8
Opcode Fuzzy Hash: e57c2ccb74947bebc886e5dc0d5b9db5fac8d606ed3479ddbad71288d269a18b
Instruction Fuzzy Hash: 6F210371F883159BDB108E98DC4079DF7E5EF85750F18813AE949AB358D7B09C21CB81

Function 13B1C865 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction ID: 192da4099511e48320216c81020c22859a49a178cfe0af2fa39356536b3c913f
Opcode Fuzzy Hash: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction Fuzzy Hash: F0F06272B086158FD710CF98D840699F7E4EF84260F19867AEA68DB351D670ED118781

Function 13B1C865 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction ID: 192da4099511e48320216c81020c22859a49a178cfe0af2fa39356536b3c913f
Opcode Fuzzy Hash: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction Fuzzy Hash: F0F06272B086158FD710CF98D840699F7E4EF84260F19867AEA68DB351D670ED118781

Function 13B1C865 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction ID: 192da4099511e48320216c81020c22859a49a178cfe0af2fa39356536b3c913f
Opcode Fuzzy Hash: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction Fuzzy Hash: F0F06272B086158FD710CF98D840699F7E4EF84260F19867AEA68DB351D670ED118781

Function 13B1C865 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction ID: 192da4099511e48320216c81020c22859a49a178cfe0af2fa39356536b3c913f
Opcode Fuzzy Hash: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction Fuzzy Hash: F0F06272B086158FD710CF98D840699F7E4EF84260F19867AEA68DB351D670ED118781

Function 13B1C865 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction ID: 192da4099511e48320216c81020c22859a49a178cfe0af2fa39356536b3c913f
Opcode Fuzzy Hash: daa8c49e56ff8cb03e7da7fbd4e034b71cf7c9794e52a1842374f66f4ac7b9f8
Instruction Fuzzy Hash: F0F06272B086158FD710CF98D840699F7E4EF84260F19867AEA68DB351D670ED118781

Function 13B1C8AB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction ID: 7298e297647c5e49930c27f9b12c4d6888ce701aea353b7bd9a96f29543128fd
Opcode Fuzzy Hash: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction Fuzzy Hash: F1F0E962A086454FE700CE6DEC813C5FB94EB45150F28457AE9ADCB312D211D5578741

Function 13B1C8AB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction ID: 7298e297647c5e49930c27f9b12c4d6888ce701aea353b7bd9a96f29543128fd
Opcode Fuzzy Hash: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction Fuzzy Hash: F1F0E962A086454FE700CE6DEC813C5FB94EB45150F28457AE9ADCB312D211D5578741

Function 13B1C8AB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction ID: 7298e297647c5e49930c27f9b12c4d6888ce701aea353b7bd9a96f29543128fd
Opcode Fuzzy Hash: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction Fuzzy Hash: F1F0E962A086454FE700CE6DEC813C5FB94EB45150F28457AE9ADCB312D211D5578741

Function 13B1C8AB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction ID: 7298e297647c5e49930c27f9b12c4d6888ce701aea353b7bd9a96f29543128fd
Opcode Fuzzy Hash: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction Fuzzy Hash: F1F0E962A086454FE700CE6DEC813C5FB94EB45150F28457AE9ADCB312D211D5578741

Function 13B1C8AB Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B1C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction ID: 7298e297647c5e49930c27f9b12c4d6888ce701aea353b7bd9a96f29543128fd
Opcode Fuzzy Hash: eda2af7dba3f5e78e57934b1d84ee2a00df8ae19c791336db8fa4e3cd5bafed5
Instruction Fuzzy Hash: F1F0E962A086454FE700CE6DEC813C5FB94EB45150F28457AE9ADCB312D211D5578741

Function 13B16668 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dd0dd406049511682670b6dac73914a5f165d7b85e93aebecf78a9657845c8
Instruction ID: 173204636f8e4cdb0f2dfb936e40ba310362ec7350c490e19e50e37c58bd4f79
Opcode Fuzzy Hash: 64dd0dd406049511682670b6dac73914a5f165d7b85e93aebecf78a9657845c8
Instruction Fuzzy Hash: 4CE0E5B124D3915EE3119A19AC50B96FFACDB81720F14819AFC848F096D75185648652

Function 13B16668 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dd0dd406049511682670b6dac73914a5f165d7b85e93aebecf78a9657845c8
Instruction ID: 173204636f8e4cdb0f2dfb936e40ba310362ec7350c490e19e50e37c58bd4f79
Opcode Fuzzy Hash: 64dd0dd406049511682670b6dac73914a5f165d7b85e93aebecf78a9657845c8
Instruction Fuzzy Hash: 4CE0E5B124D3915EE3119A19AC50B96FFACDB81720F14819AFC848F096D75185648652

Function 13B16668 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a86b3c7337ec521342de0b62143fb8b2ccdf122f31aa1efc538a8fe54725e1
Instruction ID: 173204636f8e4cdb0f2dfb936e40ba310362ec7350c490e19e50e37c58bd4f79
Opcode Fuzzy Hash: 17a86b3c7337ec521342de0b62143fb8b2ccdf122f31aa1efc538a8fe54725e1
Instruction Fuzzy Hash: 4CE0E5B124D3915EE3119A19AC50B96FFACDB81720F14819AFC848F096D75185648652

Function 13B177B5 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction ID: bc7d34d48449a141a332ba9379aed18567a74d381b7e349e5dfcfacb8afdaa1e
Opcode Fuzzy Hash: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction Fuzzy Hash: A3D0A7205A91D058D33291797805B45FF45CB93159F1805BBE5988A1D2A1D204D5C1B2

Function 13B177B5 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction ID: bc7d34d48449a141a332ba9379aed18567a74d381b7e349e5dfcfacb8afdaa1e
Opcode Fuzzy Hash: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction Fuzzy Hash: A3D0A7205A91D058D33291797805B45FF45CB93159F1805BBE5988A1D2A1D204D5C1B2

Function 13B177B5 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B17000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction ID: bc7d34d48449a141a332ba9379aed18567a74d381b7e349e5dfcfacb8afdaa1e
Opcode Fuzzy Hash: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction Fuzzy Hash: A3D0A7205A91D058D33291797805B45FF45CB93159F1805BBE5988A1D2A1D204D5C1B2

Function 13B177B5 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction ID: bc7d34d48449a141a332ba9379aed18567a74d381b7e349e5dfcfacb8afdaa1e
Opcode Fuzzy Hash: d1682234a66f69abf8e54c433252c6529145811e1dafaa8724f003cea2d7a6eb
Instruction Fuzzy Hash: A3D0A7205A91D058D33291797805B45FF45CB93159F1805BBE5988A1D2A1D204D5C1B2

Function 13B1A346 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B14000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction ID: 5c0c5a5f24a4e806b3743fd7962b1056a498c2d70a050ce8dde15285ade46b68
Opcode Fuzzy Hash: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction Fuzzy Hash: 0FB012B3289104C643209A9DF8914E4F34DEA420BFF1042F7D90844100261B406211F1

Function 13B1A346 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B15000, based on PE: false

Associated: 00000000.00000003.2601131818.0000000013B14000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction ID: 5c0c5a5f24a4e806b3743fd7962b1056a498c2d70a050ce8dde15285ade46b68
Opcode Fuzzy Hash: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction Fuzzy Hash: 0FB012B3289104C643209A9DF8914E4F34DEA420BFF1042F7D90844100261B406211F1

Function 13B1A346 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B16000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction ID: 5c0c5a5f24a4e806b3743fd7962b1056a498c2d70a050ce8dde15285ade46b68
Opcode Fuzzy Hash: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction Fuzzy Hash: 0FB012B3289104C643209A9DF8914E4F34DEA420BFF1042F7D90844100261B406211F1

Function 13B1A346 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2601646833.0000000013B16000.00000010.00000800.00020000.00000000.sdmp, Offset: 13B19000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13b14000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction ID: 5c0c5a5f24a4e806b3743fd7962b1056a498c2d70a050ce8dde15285ade46b68
Opcode Fuzzy Hash: 9a4f71e4efe7a9fd0db150e7136d15b167bf01632b0aace6f178ea1b95d5fd6f
Instruction Fuzzy Hash: 0FB012B3289104C643209A9DF8914E4F34DEA420BFF1042F7D90844100261B406211F1

Function 1067105F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106710A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106710AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671567 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067156F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067155F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106715DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106711A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106711AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106711B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671587 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067158F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671597 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671197 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067119F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671A1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106716F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106716FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106716D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106716DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671687 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067168F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671E97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671E9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671747 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067174F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671757 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067133F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067173F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671717 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067171F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10671FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644796385.0000000010671000.00000010.00000800.00020000.00000000.sdmp, Offset: 10671000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10671000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: 1089408414d9cda444aeb9154aff167c4d10a460a9e188836207a85fcdc9af50
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10672C1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D4F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672D5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 106729E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672DEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672E17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672A17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672ACF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672F6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672F77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672F8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10672F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644746357.0000000010672000.00000010.00000800.00020000.00000000.sdmp, Offset: 10672000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10672000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction ID: 4a21168ef5fb37716b73ee67cb506fbfa45f95c5b4597758e82428e74b356d87
Opcode Fuzzy Hash: 8af8e666c985d769abef00b650d2a0ef45d806e04ace0a9bb6a7d9e37592bb45
Instruction Fuzzy Hash:

Function 10670467 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670867 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067086F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067046F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670847 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670047 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067084F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670057 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670857 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067005F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067085F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067002F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670037 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670017 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067001F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670CE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670CF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106700C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106700CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670CDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106708DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106700A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670CBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106700BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670C87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067048F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067009F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670567 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670577 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067057F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670547 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067054F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067055F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670127 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670D2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670507 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670107 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067010F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670117 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067011F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106709E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670267 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670A67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670277 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067027F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670E47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067024F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067025F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670A3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670AFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106702DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106706AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106702B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670A87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067068F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067028F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670297 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067029F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670767 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670347 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670757 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067075F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067072F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670737 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670337 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067033F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 1067070F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670317 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106707F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106707FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106707CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106703CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106707D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 106707AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10670787 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2644836029.0000000010670000.00000010.00000800.00020000.00000000.sdmp, Offset: 10670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10670000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction ID: b7bbf75c6179d0715a9e3d428c2396e58d43f5d48fb71c0b1513bb439b5c2711
Opcode Fuzzy Hash: 038838da03f92041eb97c124a34e167666dd69173e865bf4b26b04ae9f25f26a
Instruction Fuzzy Hash:

Function 10D200D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D200CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D200F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D200FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CEF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D204EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D200EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20087 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20487 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2008F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20CB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20857 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2085F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2007F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20C7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20467 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20867 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20017 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2003F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D209DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20DE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2099F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D209A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20557 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2055F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20147 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2054F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20577 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2096F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2056F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20137 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2013F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D202D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20AD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20AF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20297 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2028F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20AB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D202AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20A5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20E5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20647 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20E77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20A7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20667 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20E67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2066F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2061F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20607 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20A37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20E3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2063F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20627 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D203D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D203DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D207F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D207E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D203E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20BE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D207EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D203BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20757 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2075F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20347 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2074F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2077F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20F6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20B1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2030F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20337 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2033F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2073F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20727 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20B27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2072F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D2032F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Function 10D20B2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2602205112.0000000010D20000.00000010.00000800.00020000.00000000.sdmp, Offset: 10D20000, based on PE: false

Associated: 00000000.00000003.2643930898.0000000010D20000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10d20000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction ID: 3a5d0256de3364f8f61e0a7884d9a3019d6d7d684c8c179e42fb851d5d4b1083
Opcode Fuzzy Hash: 7968d173d69effb785a1839bb939dee08da36297af09920068207eeeb3fd1474
Instruction Fuzzy Hash:

Non-executed Functions

Function 04E600A0 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2708493140.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4dd0000_LisectAVT_2403002B_286.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ad50bc8ac6fe3d13b2bd32382ddfbe3398cadc512f0d8de8b98dd1a9646753
Instruction ID: 1866a1edf4c0cb9fd3c43bffe348dc0ae5145f814b8a368cbc35fcadb1601388
Opcode Fuzzy Hash: f0ad50bc8ac6fe3d13b2bd32382ddfbe3398cadc512f0d8de8b98dd1a9646753
Instruction Fuzzy Hash: 76C1DEB19443449BE721EF65D880B2BBBE9FF85708F14582DE48A0B342E7B1F554CB52

Function 0043F78B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,0043F83B,?,0043AE02), ref: 0043F798
TlsGetValue.KERNEL32(00000005,?,0043AE02), ref: 0043F7AF
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0043AE02), ref: 0043F7C4
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0043F7DF

Strings

KERNEL32.DLL, xrefs: 0043F7BF
DecodePointer, xrefs: 0043F7D9

Memory Dump Source

Source File: 00000000.00000002.2698519737.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2698453549.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698654394.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698728259.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.000000000046D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000570000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000576000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2698785893.0000000000583000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2699884196.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700460692.00000000005A3000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.000000000075D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2700731848.00000000008A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_LisectAVT_2403002B_286.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 88f913852e08c1575371cd1b3d4c95e2569a501468fffc6810ca2a17cca08315
Instruction ID: 1011355f33926e0c44f682315990b034e323b83c7b84978fd469daf0dde1a0ad
Opcode Fuzzy Hash: 88f913852e08c1575371cd1b3d4c95e2569a501468fffc6810ca2a17cca08315
Instruction Fuzzy Hash: 42F09031A002139B86126B75EE4495F3A98EF0A791F251437FC04D23B1EB68CD868A9E

Analysis Process: LisectAVT_2403002B_286_Update.exePID: 4756, Parent PID: 5532COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	74

Executed Functions

Function 04E90B90 Relevance: 359.7, APIs: 130, Strings: 75, Instructions: 978
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 04E90BF9
TlsAlloc.KERNEL32(00000000,?), ref: 04E90C24
TlsAlloc.KERNEL32 ref: 04E90C2B
TlsAlloc.KERNEL32 ref: 04E90C32
TlsAlloc.KERNEL32 ref: 04E90C39
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 04E90C54
GetProcAddress.KERNEL32(00000000), ref: 04E90C61
GetCurrentProcess.KERNEL32(04EC8D28), ref: 04E90C71
IsWow64Process.KERNEL32(00000000), ref: 04E90C78
LoadLibraryW.KERNEL32(ntdll.dll), ref: 04E90CA7
GetProcAddress.KERNEL32(00000000,DbgPrint), ref: 04E90CB1
GetProcAddress.KERNEL32(00000000,RtlMoveMemory), ref: 04E90CBE
GetProcAddress.KERNEL32(00000000,RtlZeroMemory), ref: 04E90CCB
GetProcAddress.KERNEL32(00000000,RtlCompareMemory), ref: 04E90CD8
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 04E90CE5
GetProcAddress.KERNEL32(00000000,RtlFreeUnicodeString), ref: 04E90CF2
GetProcAddress.KERNEL32(00000000,NtQueryKey), ref: 04E90CFF
GetProcAddress.KERNEL32(00000000,NtCreateKey), ref: 04E90D0C
GetProcAddress.KERNEL32(00000000,NtOpenKey), ref: 04E90D19
GetProcAddress.KERNEL32(00000000,RtlUpcaseUnicodeChar), ref: 04E90D26
GetProcAddress.KERNEL32(00000000,RtlCompareUnicodeString), ref: 04E90D33
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 04E90D40
GetProcAddress.KERNEL32(00000000,NtOpenDirectoryObject), ref: 04E90D4D
GetProcAddress.KERNEL32(00000000,NtOpenSymbolicLinkObject), ref: 04E90D5A
GetProcAddress.KERNEL32(00000000,NtQuerySymbolicLinkObject), ref: 04E90D67
GetProcAddress.KERNEL32(00000000,NtQueueApcThread), ref: 04E90D74
GetProcAddress.KERNEL32(00000000,RtlCreateSecurityDescriptor), ref: 04E90D81
GetProcAddress.KERNEL32(00000000,NtSetIoCompletion), ref: 04E90D8E
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 04E90D9B
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 04E90DA8
GetProcAddress.KERNEL32(00000000,RtlDosPathNameToNtPathName_U), ref: 04E90DB5
GetProcAddress.KERNEL32(00000000,NtCreateIoCompletion), ref: 04E90DC2
GetProcAddress.KERNEL32(00000000,NtCreateWaitablePort), ref: 04E90DCF
GetProcAddress.KERNEL32(00000000,NtReplyWaitReceivePort), ref: 04E90DDC
GetProcAddress.KERNEL32(00000000,NtAcceptConnectPort), ref: 04E90DE9
GetProcAddress.KERNEL32(00000000,NtCompleteConnectPort), ref: 04E90DF6
GetProcAddress.KERNEL32(00000000,NtReplyPort), ref: 04E90E03
GetProcAddress.KERNEL32(00000000,NtConnectPort), ref: 04E90E10
GetProcAddress.KERNEL32(00000000,NtRequestWaitReplyPort), ref: 04E90E1D
GetProcAddress.KERNEL32(00000000,RtlRandom), ref: 04E90E2A
GetProcAddress.KERNEL32(00000000,NtQueryAttributesFile), ref: 04E90E37
GetProcAddress.KERNEL32(00000000,NtQueryInformationFile), ref: 04E90E44
GetProcAddress.KERNEL32(00000000,NtSetSecurityObject), ref: 04E90E51
GetProcAddress.KERNEL32(00000000,RtlDowncaseUnicodeChar), ref: 04E90E5E
GetProcAddress.KERNEL32(00000000,NtCreateIoCompletion), ref: 04E90E6B
GetProcAddress.KERNEL32(00000000,NtRemoveIoCompletion), ref: 04E90E78
GetProcAddress.KERNEL32(00000000,NtOpenFile), ref: 04E90E85
GetProcAddress.KERNEL32(00000000,NtCreateFile), ref: 04E90E92
GetProcAddress.KERNEL32(00000000,NtWaitForSingleObject), ref: 04E90E9F
GetProcAddress.KERNEL32(00000000,NtCreateSection), ref: 04E90EAC
GetProcAddress.KERNEL32(00000000,NtClose), ref: 04E90EB9
GetProcAddress.KERNEL32(00000000,memset), ref: 04E90EC6
LoadLibraryW.KERNEL32(kernel32.dll), ref: 04E90ED2
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 04E90EDC
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 04E90EE9
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 04E90EF6
GetProcAddress.KERNEL32(00000000,GetCurrentActCtx), ref: 04E90F03
GetProcAddress.KERNEL32(00000000,OpenThread), ref: 04E90F10
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 04E90F1D
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 04E90F2A
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 04E90F37
GetProcAddress.KERNEL32(00000000,TlsSetValue), ref: 04E90F44
GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 04E90F51
GetProcAddress.KERNEL32(00000000,AddVectoredExceptionHandler), ref: 04E90F5E
GetProcAddress.KERNEL32(00000000,RemoveVectoredExceptionHandler), ref: 04E90F6B
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 04E90F78
RtlAddVectoredExceptionHandler.NTDLL(00000001,04E667A0), ref: 04E90F86

Part of subcall function 04E93F10: RtlZeroMemory.NTDLL(00000000,00000008), ref: 04E93F1A

VirtualAlloc.KERNELBASE(00000000,00000025,00001000,00000040), ref: 04E90FB1

Part of subcall function 04E93F30: RtlMoveMemory.NTDLL(?,?,00000000), ref: 04E93F3F

Part of subcall function 04E9CD00: InterlockedCompareExchange.KERNEL32(04EC8D58,00000000,00000000), ref: 04E9CD82
Part of subcall function 04E9CD00: RtlAddVectoredExceptionHandler.NTDLL(00000001,04E9CAE0), ref: 04E9CD9F

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,04EC8C2C,00000000), ref: 04E90FF3
GetSecurityDescriptorSacl.ADVAPI32(00972A48,?,04EC8C28,?), ref: 04E91022
InitializeSecurityDescriptor.ADVAPI32(04EC8C14,00000001), ref: 04E91033
SetSecurityDescriptorSacl.ADVAPI32(04EC8C14,00000001,00972A5C,?), ref: 04E91048
InitializeSecurityDescriptor.ADVAPI32(04EC8C00,00000001), ref: 04E91055
SetSecurityDescriptorDacl.ADVAPI32(04EC8C00,00000001,00000000,00000000), ref: 04E91062
VirtualAlloc.KERNELBASE(00000000,01000000,00001000,00000004), ref: 04E91076
GetSystemInfo.KERNEL32(04EC8ABC), ref: 04E9109F
GetVersionExW.KERNEL32(04EC8AE0), ref: 04E910B4
RtlUpcaseUnicodeChar.NTDLL(00000000), ref: 04E91114
GetCurrentProcess.KERNEL32(00000008,?), ref: 04E91169
OpenProcessToken.ADVAPI32(00000000), ref: 04E91170
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 04E91190
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 04E911BD
ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 04E911CF
LocalFree.KERNEL32(?,?,?), ref: 04E91213
FindCloseChangeNotification.KERNELBASE(?), ref: 04E9122B
RtlInitUnicodeString.NTDLL(04EC8AA8,Wow6432Node), ref: 04E9123D
GetProcessHeap.KERNEL32(00000000,?), ref: 04E91261
HeapAlloc.KERNEL32(00000000), ref: 04E91268
LoadLibraryW.KERNELBASE(sxs.dll), ref: 04E912A3
GetProcAddress.KERNEL32(00000000,SxsGenerateActivationContext), ref: 04E912B8
GetProcAddress.KERNEL32(6FCA0000,SxspGeneratePolicyPathOnAssemblyIdentity), ref: 04E912CA
GetProcAddress.KERNEL32(6FCA0000,SxspGenerateManifestPathOnAssemblyIdentity), ref: 04E912DD
FindResourceW.KERNELBASE(6FCA0000,00000001,00000010), ref: 04E912F2
LoadResource.KERNEL32(6FCA0000,00000000), ref: 04E91302
LockResource.KERNEL32(00000000), ref: 04E91309
SizeofResource.KERNEL32(6FCA0000,00000000), ref: 04E91318
GetModuleHandleW.KERNEL32(ntdll.dll,RtlCreateActivationContext), ref: 04E9134C
GetProcAddress.KERNEL32(00000000), ref: 04E91353
LoadLibraryW.KERNEL32(advapi32.dll), ref: 04E9135F
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 04E9136C
LoadLibraryW.KERNELBASE(mpr.dll), ref: 04E91378
GetProcAddress.KERNEL32(00000000,WNetGetConnectionW), ref: 04E91385
GetProcessHeap.KERNEL32 ref: 04E9139E
HeapAlloc.KERNEL32(00000000), ref: 04E913A1
GetComputerNameW.KERNEL32(0097A7D0,?), ref: 04E913C2
GetLastError.KERNEL32 ref: 04E913C8
GetProcessHeap.KERNEL32(00000000,0097A7D0), ref: 04E913EB
HeapReAlloc.KERNEL32(00000000), ref: 04E913EE
GetComputerNameW.KERNEL32(00000000,?), ref: 04E913FF
GetCurrentProcessId.KERNEL32 ref: 04E91401
RegOpenKeyW.ADVAPI32(80000005,System,?), ref: 04E9143A
NtQueryKey.NTDLL(?,00000007,00000000,00010000,?), ref: 04E91458
NtQueryKey.NTDLL(?,00000005,00000000,00010000,?), ref: 04E9147C
RegCloseKey.ADVAPI32(?), ref: 04E914B0
RegOpenKeyW.ADVAPI32(80000005,System,?), ref: 04E914E7
NtQueryKey.NTDLL(?,00000007,00000000,00010000,?), ref: 04E91502
RegCloseKey.ADVAPI32(?), ref: 04E9151D
NtCreateKey.NTDLL(?,00020019,00000000,00000000,00000000), ref: 04E9157F
NtOpenKey.NTDLL(?,00020019,00000000), ref: 04E91630
NtQueryKey.NTDLL(?,00000000,00000000,00000000,?), ref: 04E91667
CloseHandle.KERNEL32(?), ref: 04E916BB
NtQueryAttributesFile.NTDLL(00000000,04EC8954), ref: 04E91734
FileTimeToSystemTime.KERNEL32(?,?), ref: 04E9175B
GetModuleHandleW.KERNEL32(ntdll,NtQueryObject), ref: 04E9177C
GetProcAddress.KERNEL32(00000000), ref: 04E91783
NtQueryInformationFile.NTDLL(04EC8954,?,?,00000008,00000013), ref: 04E917C5
SetLastError.KERNEL32 ref: 04E9180E
CreateActCtxW.KERNEL32(?), ref: 04E9181C
GetLastError.KERNEL32 ref: 04E91822
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:P(A;OICI;GA;;;WD),00000001,04EC896C,00000000), ref: 04E9187C

Strings

NtCreateWaitablePort, xrefs: 04E90DC4
NtReplyWaitReceivePort, xrefs: 04E90DD1
NtRemoveIoCompletion, xrefs: 04E90E6D
ntdll.dll, xrefs: 04E90C90, 04E91347
Wow64DisableWow64FsRedirection, xrefs: 04E90F12
advapi32.dll, xrefs: 04E91355
RtlCreateSecurityDescriptor, xrefs: 04E90D76
This is a demo version of BoxedApp SDKThe full registered version doesn't show this notificationObtain a full version, purchas, xrefs: 04E91245, 04E91275, 04E91290
SxsGenerateActivationContext, xrefs: 04E912B2
NtQuerySymbolicLinkObject, xrefs: 04E90D5C
NtOpenKey, xrefs: 04E90D0E
D:P(A;OICI;GA;;;WD), xrefs: 04E9186D
RtlUpcaseUnicodeChar, xrefs: 04E90D1B
NtSetSecurityObject, xrefs: 04E90E46
CreateActCtxW, xrefs: 04E90ED6
NtUnmapViewOfSection, xrefs: 04E90D9D
RtlZeroMemory, xrefs: 04E90CC0
memset, xrefs: 04E90EBB
RtlCompareUnicodeString, xrefs: 04E90D28
NtQueryInformationFile, xrefs: 04E90E39
NtClose, xrefs: 04E90EAE
NtMapViewOfSection, xrefs: 04E90D90
NtQueryObject, xrefs: 04E91772
Wow6432Node, xrefs: 04E91233
S:(ML;;NW;;;LW), xrefs: 04E90FE9
NtAcceptConnectPort, xrefs: 04E90DDE
RegDeleteKeyExW, xrefs: 04E90F6D, 04E91361
RtlCreateActivationContext, xrefs: 04E91342
Wow64RevertWow64FsRedirection, xrefs: 04E90F1F
NtRequestWaitReplyPort, xrefs: 04E90E12
RemoveVectoredExceptionHandler, xrefs: 04E90F60
DeactivateActCtx, xrefs: 04E90EEB
SxspGeneratePolicyPathOnAssemblyIdentity, xrefs: 04E912C4
GetThreadPreferredUILanguages, xrefs: 04E90F46
NtQueryAttributesFile, xrefs: 04E90E2C
OpenThread, xrefs: 04E90F05
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 04E915B2
DbgPrint, xrefs: 04E90CAB
RtlMoveMemory, xrefs: 04E90CB3
NtOpenSymbolicLinkObject, xrefs: 04E90D4F
NtOpenFile, xrefs: 04E90E7A
GetCurrentActCtx, xrefs: 04E90EF8
kernel32.dll, xrefs: 04E90C40, 04E90EC8
ntdll, xrefs: 04E91777
sxs.dll, xrefs: 04E9129E
WNetGetConnectionW, xrefs: 04E9137A
NtOpenDirectoryObject, xrefs: 04E90D42
NtQueryInformationProcess, xrefs: 04E90D35
NtConnectPort, xrefs: 04E90E05
RtlCompareMemory, xrefs: 04E90CCD
mpr.dll, xrefs: 04E9136E
invalid_path, xrefs: 04E9153B
GetSystemWow64DirectoryW, xrefs: 04E90F2C
NtCreateIoCompletion, xrefs: 04E90DB7, 04E90E60
NtSetIoCompletion, xrefs: 04E90D83
NtQueueApcThread, xrefs: 04E90D69
TlsSetValue, xrefs: 04E90F39
NtCreateKey, xrefs: 04E90D01
AddVectoredExceptionHandler, xrefs: 04E90F53
NtCreateSection, xrefs: 04E90EA1
RtlFreeUnicodeString, xrefs: 04E90CE7
ActivateActCtx, xrefs: 04E90EDE
NtCompleteConnectPort, xrefs: 04E90DEB
NtReplyPort, xrefs: 04E90DF8
System, xrefs: 04E91424, 04E914D1
RtlDowncaseUnicodeChar, xrefs: 04E90E53
RtlRandom, xrefs: 04E90E1F
NtWaitForSingleObject, xrefs: 04E90E94
IsWow64Process, xrefs: 04E90C3B
SxspGenerateManifestPathOnAssemblyIdentity, xrefs: 04E912D2
RtlDosPathNameToNtPathName_U, xrefs: 04E90DAA
, xrefs: 04E917ED
NtQueryKey, xrefs: 04E90CF4
NtCreateFile, xrefs: 04E90E87
RtlInitUnicodeString, xrefs: 04E90CDA

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AddressProc$AllocDescriptorSecurity$Process$HeapLoadQuery$Library$CloseHandleOpenResourceString$ConvertCurrentErrorFileInformationLastModuleToken$ComputerCreateExceptionFindHandlerInitializeMemoryNameSaclSystemTimeUnicodeVectoredVirtual$AttributesChangeCharCompareCountDaclExchangeFreeInfoInitInterlockedLocalLockMoveNotificationSizeofTickUpcaseVersionWow64Zero
String ID: $ActivateActCtx$AddVectoredExceptionHandler$CreateActCtxW$D:P(A;OICI;GA;;;WD)$DbgPrint$DeactivateActCtx$GetCurrentActCtx$GetSystemWow64DirectoryW$GetThreadPreferredUILanguages$IsWow64Process$NtAcceptConnectPort$NtClose$NtCompleteConnectPort$NtConnectPort$NtCreateFile$NtCreateIoCompletion$NtCreateKey$NtCreateSection$NtCreateWaitablePort$NtMapViewOfSection$NtOpenDirectoryObject$NtOpenFile$NtOpenKey$NtOpenSymbolicLinkObject$NtQueryAttributesFile$NtQueryInformationFile$NtQueryInformationProcess$NtQueryKey$NtQueryObject$NtQuerySymbolicLinkObject$NtQueueApcThread$NtRemoveIoCompletion$NtReplyPort$NtReplyWaitReceivePort$NtRequestWaitReplyPort$NtSetIoCompletion$NtSetSecurityObject$NtUnmapViewOfSection$NtWaitForSingleObject$OpenThread$RegDeleteKeyExW$RemoveVectoredExceptionHandler$RtlCompareMemory$RtlCompareUnicodeString$RtlCreateActivationContext$RtlCreateSecurityDescriptor$RtlDosPathNameToNtPathName_U$RtlDowncaseUnicodeChar$RtlFreeUnicodeString$RtlInitUnicodeString$RtlMoveMemory$RtlRandom$RtlUpcaseUnicodeChar$RtlZeroMemory$S:(ML;;NW;;;LW)$SxsGenerateActivationContext$SxspGenerateManifestPathOnAssemblyIdentity$SxspGeneratePolicyPathOnAssemblyIdentity$System$This is a demo version of BoxedApp SDKThe full registered version doesn't show this notificationObtain a full version, purchas$TlsSetValue$WNetGetConnectionW$Wow6432Node$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion$advapi32.dll$invalid_path$kernel32.dll$memset$mpr.dll$ntdll$ntdll.dll$sxs.dll
API String ID: 1202252573-2233602225
Opcode ID: 8614cf2e8b16f1172e6ea5609ba49a5f71d2326895488d8742cb9cbd59065f52
Instruction ID: 912364a0972e3024582fa3d7179412fbea190bbb69b9f92b33d46591d0d08f70
Opcode Fuzzy Hash: 8614cf2e8b16f1172e6ea5609ba49a5f71d2326895488d8742cb9cbd59065f52
Instruction Fuzzy Hash: B6728170A40304AFE754BF76ED49F5B7AE9FB84706F00582AF54497284EAB8AC05CF52

Function 04DFB200 Relevance: 50.2, APIs: 24, Strings: 4, Instructions: 1217sharenativeCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(04DFA0C1,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04DFB205
TlsGetValue.KERNEL32(00000014,?), ref: 04DFB222
TlsSetValue.KERNEL32(00000014,-00000001), ref: 04DFB233

Part of subcall function 04E30B00: SetErrorMode.KERNELBASE(00000000,?,04DFB244,00000001), ref: 04E30B08

Part of subcall function 04E304A0: RtlInitUnicodeString.NTDLL(00000000,00000000), ref: 04E304B0

GetCurrentProcess.KERNEL32(00000017,?,00000024,00000000,00000004,00000004,00000005,?,?,\??\,00000001,?,?,00000001), ref: 04DFB359
NtQueryInformationProcess.NTDLL(?,?,\??\,00000001,?,?,00000001), ref: 04DFB369
WNetGetConnectionW.MPR(00000001,00000001,?), ref: 04DFB3FA
WNetGetConnectionW.MPR(00000001,00000001,?), ref: 04DFB44E

Part of subcall function 04E302E0: RtlInitUnicodeString.NTDLL(?,00000000), ref: 04E302E9

RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04DFB656

Strings

\??\, xrefs: 04DFB273, 04DFC280
\Device\, xrefs: 04DFB700
\??\Z:, xrefs: 04DFB295, 04DFC2B0
\??\UNC, xrefs: 04DFB472, 04DFB9E9

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: StringUnicode$ConnectionInitProcessValue$CompareCurrentErrorInformationModeQuery_chkstk
String ID: \??\$\??\UNC$\??\Z:$\Device\
API String ID: 1319109772-2600112092
Opcode ID: 5e7af0bcbf073f1b46a62ac1bb4a8c31755bb65c7e13e5ffb1a28011f16630a0
Instruction ID: cafa32b193252774f2930d484611fc51eb97bd56c2e50bdcc942e9c8c4920ef9
Opcode Fuzzy Hash: 5e7af0bcbf073f1b46a62ac1bb4a8c31755bb65c7e13e5ffb1a28011f16630a0
Instruction Fuzzy Hash: 4DA26B716043409BE735EB60CC94AEFB3E9FF84705F01591DE68A5B294EB34B905CBA2

Function 04E94BD0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 145
nativelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?), ref: 04E94BD9
wsprintfW.USER32 ref: 04E94C0B
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 04E94C3B
CreateMutexW.KERNELBASE(?,00000001,?), ref: 04E94C49
LocalFree.KERNEL32(?), ref: 04E94C5A
GetModuleHandleW.KERNEL32(ntdll.dll,NtSetSecurityObject,?), ref: 04E94C7B
GetProcAddress.KERNEL32(00000000), ref: 04E94C82
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,?,00000000), ref: 04E94CC2
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 04E94CEA
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 04E94CFB
SetSecurityDescriptorSacl.ADVAPI32(?,00000001,?,?), ref: 04E94D0E
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 04E94D3A
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 04E94D45
NtSetSecurityObject.NTDLL(00000000,00000010,?), ref: 04E94D53
NtSetSecurityObject.NTDLL(00000000,00000004,?), ref: 04E94D5D
LocalFree.KERNEL32(?), ref: 04E94D68

Strings

%s_%.8x_%.8x_%.8x, xrefs: 04E94C05
D:P(A;OICI;GA;;;WD), xrefs: 04E94C2E
NtSetSecurityObject, xrefs: 04E94C71
S:(ML;;NW;;;LW), xrefs: 04E94CB5
ntdll.dll, xrefs: 04E94C76
bx_process_mutex, xrefs: 04E94BFC

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Security$Descriptor$ConvertFreeInitializeLocalObjectSaclString$AddressCreateCurrentDaclHandleModuleMutexProcProcesswsprintf
String ID: %s_%.8x_%.8x_%.8x$D:P(A;OICI;GA;;;WD)$NtSetSecurityObject$S:(ML;;NW;;;LW)$bx_process_mutex$ntdll.dll
API String ID: 83868107-2474672594
Opcode ID: 1dd69b1c3bcdab3a8a420fb549d9930663617b4bb8f57650c436a0ef4fd41654
Instruction ID: 3880c31df89c6b1ad3c31b3dad8538a7d0f2f3d1ebc84bfc4507490cc7c0efdc
Opcode Fuzzy Hash: 1dd69b1c3bcdab3a8a420fb549d9930663617b4bb8f57650c436a0ef4fd41654
Instruction Fuzzy Hash: 20415DB1108344AFD310DF65EC85EAFB7E9EB88705F40491EF684D2280E7B9ED458B66

Function 04E7E190 Relevance: 37.7, APIs: 10, Strings: 11, Instructions: 902
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/c ", xrefs: 04E7E4BF
EXTENDED_STARTUPINFO_PRESENT presents, but we experienced problems when this flag specified. Current implementation clears this fl, xrefs: 04E7E1D3
This attempt will use a stub file created on a disk if virtual process is going to be started, xrefs: 04E7E2AA
/c , xrefs: 04E7E589
. Returning with FALSE., xrefs: 04E7ECCD
Attempts count (, xrefs: 04E7ECDA
ComSpec, xrefs: 04E7E43D
Attempt #, xrefs: 04E7E23E
sysapi/process, xrefs: 04E7E1D8, 04E7E243, 04E7E2AF, 04E7ECDF
) reaches maximum , xrefs: 04E7ECD4
to run the process, xrefs: 04E7E238

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$ErrorFileLastLocalPrintProcessThreadTimeWrite
String ID: /c $ /c "$ to run the process$) reaches maximum $. Returning with FALSE.$Attempt #$Attempts count ($ComSpec$EXTENDED_STARTUPINFO_PRESENT presents, but we experienced problems when this flag specified. Current implementation clears this fl$This attempt will use a stub file created on a disk if virtual process is going to be started$sysapi/process
API String ID: 1560495884-1108957309
Opcode ID: 6bdad5f1035d60f21015c6f216cdee5832ee5de94f97b1e056f8ddabfd1730d0
Instruction ID: 3ed7a7005ec0fb8360b71a0062fb30f53250414fdafca382c5ab8268b85b9c79
Opcode Fuzzy Hash: 6bdad5f1035d60f21015c6f216cdee5832ee5de94f97b1e056f8ddabfd1730d0
Instruction Fuzzy Hash: 9D726EB1608380AFD730DF69D880A9BB7E5FFC9718F00995DE58987251EB31B905CB92

Function 04E6E640 Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 395
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

NtDeviceIoControlFile.NTDLL ref: 04E6E6B9

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

NtOpenFile.NTDLL(00000000,00100001,00000000,00000000,00000000,00000040), ref: 04E6E8D0

Part of subcall function 04E4F790: wsprintfA.USER32 ref: 04E4F967
Part of subcall function 04E4F790: memcpy.NTDLL(00000000,-00000001,?), ref: 04E4FA06
Part of subcall function 04E4F790: wsprintfA.USER32 ref: 04E4FAAD

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

Part of subcall function 04E93F30: RtlMoveMemory.NTDLL(?,?,00000000), ref: 04E93F3F

CloseHandle.KERNEL32(?), ref: 04E6EBA6

Strings

" doesn't match template \??\<drive>:, xrefs: 04E6E812
" failed, status = , xrefs: 04E6E919
BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile, xrefs: 04E6E732, 04E6E821, 04E6E928, 04E6E9CD, 04E6EA71, 04E6EAEB
: NtOpenFile(", xrefs: 04E6E923, 04E6E9C8, 04E6EA6C, 04E6EAE6
" succeed, returned handle id virtual, xrefs: 04E6EADC
: original NtDeviceIoControlFile() returned STATUS_OBJECT_NAME_NOT_FOUND, going to check if virtual drive is requested, input: ", xrefs: 04E6E72D
" succeed, returned handle is not virtual, xrefs: 04E6EA62
4, xrefs: 04E6E6C9
" succeed, handle = , xrefs: 04E6E9BE
core, xrefs: 04E6E737, 04E6E826, 04E6E92D, 04E6E9D2, 04E6EA76, 04E6EAF0
: input: ", xrefs: 04E6E81C

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: File$Currentwsprintf$CloseControlDeviceErrorFreeHandleHeapLastLocalMemoryMoveOpenPrintProcessThreadTimeWritememcpy
String ID: " doesn't match template \??\<drive>:$" failed, status = $" succeed, handle = $" succeed, returned handle id virtual$" succeed, returned handle is not virtual$4$: NtOpenFile("$: input: "$: original NtDeviceIoControlFile() returned STATUS_OBJECT_NAME_NOT_FOUND, going to check if virtual drive is requested, input: "$BoxedApp::CBoxedAppCore::My_NtDeviceIoControlFile$core
API String ID: 872436723-19479661
Opcode ID: b28038461b2ccdfbd17a1a22c911167a1d06c55bf599d43245c657eca0a08df8
Instruction ID: 8ba45daa331e4ff3c2b21903371034e88a41a3f93696cf3179994b2c772a012b
Opcode Fuzzy Hash: b28038461b2ccdfbd17a1a22c911167a1d06c55bf599d43245c657eca0a08df8
Instruction Fuzzy Hash: 91E14B70744301ABEB18FB74DC94DAF73A5AFC4648F406D2CA19697194EE34F909CB92

Function 04DD9810 Relevance: 18.7, APIs: 6, Strings: 4, Instructions: 1166
threadnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 04DD982F
RtlCompareUnicodeString.NTDLL(?,00000000,04E9E708), ref: 04DD9AF5

Part of subcall function 04E93F30: RtlMoveMemory.NTDLL(?,?,00000000), ref: 04E93F3F

Part of subcall function 04DF75F0: GetCurrentThreadId.KERNEL32 ref: 04DF75F9
Part of subcall function 04DF75F0: InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF7615
Part of subcall function 04DF75F0: InterlockedExchange.KERNEL32(?,00000000), ref: 04DF7652
Part of subcall function 04DF75F0: InterlockedDecrement.KERNEL32(?), ref: 04DF7663
Part of subcall function 04DF75F0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,04DDA1AE,?,00000000), ref: 04DF7671

Part of subcall function 04DF77E0: GetCurrentThreadId.KERNEL32 ref: 04DF77E9
Part of subcall function 04DF77E0: InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF7805
Part of subcall function 04DF77E0: InterlockedExchange.KERNEL32(?,00000000), ref: 04DF783B
Part of subcall function 04DF77E0: InterlockedDecrement.KERNEL32(?), ref: 04DF784C
Part of subcall function 04DF77E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04DDA676,?,?), ref: 04DF785A

Part of subcall function 04DF7A60: GetCurrentThreadId.KERNEL32 ref: 04DF7A6A
Part of subcall function 04DF7A60: InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF7A86
Part of subcall function 04DF7A60: InterlockedExchange.KERNEL32(?,00000000), ref: 04DF7ACC
Part of subcall function 04DF7A60: InterlockedDecrement.KERNEL32(?), ref: 04DF7ADD
Part of subcall function 04DF7A60: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,?,04DDA6AE,?,?,?), ref: 04DF7AEB

Part of subcall function 04DF7690: GetCurrentThreadId.KERNEL32 ref: 04DF7699
Part of subcall function 04DF7690: InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF76B5
Part of subcall function 04DF7690: InterlockedExchange.KERNEL32(?,00000000), ref: 04DF76E8
Part of subcall function 04DF7690: InterlockedDecrement.KERNEL32(?), ref: 04DF76F9
Part of subcall function 04DF7690: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04DDA6C0,?,?,?), ref: 04DF7707

RtlCompareUnicodeString.NTDLL(?,00000000,00000001), ref: 04DD9BB4

Part of subcall function 04E302E0: RtlInitUnicodeString.NTDLL(?,00000000), ref: 04E302E9

SetEvent.KERNEL32(?), ref: 04DDA71F
GetCurrentThread.KERNEL32 ref: 04DDA734
NtQueueApcThread.NTDLL(00000000), ref: 04DDA73B

Strings

, strFullDestPath: , xrefs: 04DDA42A
strOriginalPath = , xrefs: 04DDA418
[Isolation] NtQueryDirectoryInternal, xrefs: 04DDA42F
core, xrefs: 04DDA434

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$CompareThread$Current$DecrementReleaseSemaphore$StringUnicode$Event$InitMemoryMoveQueueReset
String ID: strOriginalPath = $, strFullDestPath: $[Isolation] NtQueryDirectoryInternal$core
API String ID: 3472816904-3104226743
Opcode ID: 95824fdf2bb5b014fd595ecebcdc26fac49b510274e71b90ae54d22636122bb2
Instruction ID: 2c1d9c4e6f2cba2729d18c9ae72a96bc61939e0b29cdd3effdda07d87ef3867e
Opcode Fuzzy Hash: 95824fdf2bb5b014fd595ecebcdc26fac49b510274e71b90ae54d22636122bb2
Instruction Fuzzy Hash: 11924F712043419FE715EF64C894EAFB3E9AFD8318F10491DE58A87294EB34F945CBA2

Function 04E80D60 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 299
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

TlsGetValue.KERNEL32(00000014), ref: 04E80D73
NtOpenFile.NTDLL ref: 04E80DC0

Part of subcall function 04E30AE0: GetLastError.KERNEL32(00000000,04E66E83,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AE3
Part of subcall function 04E30AE0: SetLastError.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AEE

Strings

, status: , xrefs: 04E8101D
, ShareAccess: , xrefs: 04E80EB2, 04E8103D
, DesiredAccess: , xrefs: 04E80EC2, 04E8104D
, OpenOptions: , xrefs: 04E80EA2, 04E8102D
CBoxedAppCore::My_NtOpenFile, szPath: , xrefs: 04E80E49, 04E80FA7
core, xrefs: 04E80E4E, 04E80FAC
, handle: , xrefs: 04E8100D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$FileOpenValue
String ID: , DesiredAccess: $, OpenOptions: $, ShareAccess: $, handle: $, status: $CBoxedAppCore::My_NtOpenFile, szPath: $core
API String ID: 3752247634-1122634519
Opcode ID: 2399acf54704b43a9ab067e65c946f2337efdadc37f36347c8583a393cd1d9a4
Instruction ID: 84def71eb2e2058ca96bee3afc05182ce1c45fd3007fa6f93c5c68b7404d94c9
Opcode Fuzzy Hash: 2399acf54704b43a9ab067e65c946f2337efdadc37f36347c8583a393cd1d9a4
Instruction Fuzzy Hash: 69A13171A14300ABEB14EF64D850A6FB7E9AFC4B08F005D2DB489D7251EA74FD05CB92

Function 04E67B00 Relevance: 12.1, APIs: 8, Instructions: 60
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000014,00000000,?,00000000,04E97792,?,00000010,04EC8C14,00000000,04E6F12E,00000000,?,?,?,00000000,?), ref: 04E67B0F
TlsSetValue.KERNEL32(00000014,-00000001,?,?,?,00000000,?), ref: 04E67B22
NtSetSecurityObject.NTDLL(?,?,?), ref: 04E67B3C
TlsGetValue.KERNEL32(00000014,?,?,?,00000000,?), ref: 04E67B4B
TlsSetValue.KERNEL32(00000014,-00000001,?,?,?,00000000,?), ref: 04E67B57
NtSetSecurityObject.NTDLL(?,?,?,00000000,?), ref: 04E67B76
TlsGetValue.KERNEL32(00000014,?,?,?,00000000,?), ref: 04E67B80
TlsSetValue.KERNEL32(00000014,-00000001,?,?,?,00000000,?), ref: 04E67B8D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Value$ObjectSecurity
String ID:
API String ID: 2619037843-0
Opcode ID: 27bdc781b4484093867e4c6aa21cf7a69d73e83c9e4f7e1a6413d2a8ec5b2d73
Instruction ID: ddf189b1627d3d80a386ab825a87e6ff3bca3e16455db6fc6b7668bd6dca7b2e
Opcode Fuzzy Hash: 27bdc781b4484093867e4c6aa21cf7a69d73e83c9e4f7e1a6413d2a8ec5b2d73
Instruction Fuzzy Hash: 0911FEB6710215AFC600FFAEEE84C6677EEFBD82567044929F504C3315CA39EC068B61

Function 04E7DAB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000018,00000000,00000000,?,?,?,?,?,?,?,?,?,?,04E7DC4F), ref: 04E7DAC6
NtQueryInformationProcess.NTDLL(00000000), ref: 04E7DACD

Part of subcall function 04E302E0: RtlInitUnicodeString.NTDLL(?,00000000), ref: 04E302E9

RtlCompareUnicodeString.NTDLL(?,00000000,comdlg32.dll), ref: 04E7DAFC

Strings

comdlg32.dll, xrefs: 04E7DAE2

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ProcessStringUnicode$CompareCurrentInformationInitQuery
String ID: comdlg32.dll
API String ID: 950093785-3498487378
Opcode ID: 8bd3463dcfb9b27183fbcce7670526e7032b448bfa6a21d12584490dac7bead6
Instruction ID: bfe319f6ac83b5a7ae7eaa0eaebd276f992e7417592449e4d70549932b92be47
Opcode Fuzzy Hash: 8bd3463dcfb9b27183fbcce7670526e7032b448bfa6a21d12584490dac7bead6
Instruction Fuzzy Hash: EB0162712042006FD714DF51C885E9BB3A9FF88266F04852DFD8697245EA34FC49C7A1

Function 04E6CF50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

NtQueryInformationProcess.NTDLL ref: 04E6D332

Strings

\??\, xrefs: 04E6D11F

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorInformationLastProcessQuery
String ID: \??\
API String ID: 932940343-3047946824
Opcode ID: f7a62ab46b67cd9aca83b2bcd838c56e98e1cb46f545b407cc93b5272706752b
Instruction ID: 3eb6fbc0402297e4ee3fcb7f881342be644b1409e48951ffb387dada0272f0cd
Opcode Fuzzy Hash: f7a62ab46b67cd9aca83b2bcd838c56e98e1cb46f545b407cc93b5272706752b
Instruction Fuzzy Hash: 3FB148B16083419BD720EF14D880DAFB3E9AFC8748F44591DF58A87255EB34FA45CBA2

Function 04DFF150 Relevance: 4.7, APIs: 3, Instructions: 208filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 04DFF1B5
NtOpenFile.NTDLL ref: 04DFF253
NtQueryDirectoryFile.NTDLL(?,?,00000000), ref: 04DFF2D0

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: File$Open$DirectoryQuery
String ID:
API String ID: 1030887729-0
Opcode ID: 479638c93ed4c31215cd0c48a6e747784a262279d91480f43621fb7c34b64ef8
Instruction ID: a740ebd47774bcb98c58039b1e89f29bb3e8dcc7a271f65c3bcc91afb48705f2
Opcode Fuzzy Hash: 479638c93ed4c31215cd0c48a6e747784a262279d91480f43621fb7c34b64ef8
Instruction Fuzzy Hash: C661A375700200ABEB25EBA4CC94FBF73A9AF88718F01051DFA469B284DA34FD44C791

Function 02656010 Relevance: 4.0, Strings: 2, Instructions: 1460COMMON

Download Yara Rule

Strings

Tjq, xrefs: 0265607B
d, xrefs: 02656EA3

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: Tjq$d
API String ID: 0-4176660553
Opcode ID: bcd67eba402c551db8e8e66b49962d18e00c3220bec3834ce9c06a746147ee51
Instruction ID: 84dda0bd55a4216c766470a6b0101b576a203452ccad6d4eb2f04cca74ecce9a
Opcode Fuzzy Hash: bcd67eba402c551db8e8e66b49962d18e00c3220bec3834ce9c06a746147ee51
Instruction Fuzzy Hash: 82B24C76A102159FCF06CF94C984D99BBB6FF48310B0A81E5E6099F272C732E9A5DF50

Function 04E85F30 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

TlsGetValue.KERNEL32(00000014), ref: 04E85F43
NtClose.NTDLL ref: 04E85F69

Part of subcall function 04E30AE0: GetLastError.KERNEL32(00000000,04E66E83,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AE3
Part of subcall function 04E30AE0: SetLastError.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AEE

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$CloseValue
String ID:
API String ID: 3977708301-0
Opcode ID: d857deba2e10f792a72ef97d4ced995ed7eafeb34ac31be7384222c8f0f8cb35
Instruction ID: a736e70f6c2cb1d86c9359ea5c693966beaaa9522fb544587b94b1e850736be3
Opcode Fuzzy Hash: d857deba2e10f792a72ef97d4ced995ed7eafeb34ac31be7384222c8f0f8cb35
Instruction Fuzzy Hash: 0B114A72204211ABC704FB68EC80C9BB3A9BF98655B04852DF94AC7255DB34FD4ACBA1

Function 0265600F Relevance: 2.1, Strings: 1, Instructions: 853COMMON

Download Yara Rule

Strings

Tjq, xrefs: 0265607B

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: Tjq
API String ID: 0-3168684612
Opcode ID: 811917d1c0bea7e7e12ae1bf1b10677eecb3488dd3f9e0eb811be029ac6ca5c1
Instruction ID: 09ba386d79ad5a538346a219eba35b25f6a49cdafc1e7e1eb3235ef93b8580c7
Opcode Fuzzy Hash: 811917d1c0bea7e7e12ae1bf1b10677eecb3488dd3f9e0eb811be029ac6ca5c1
Instruction Fuzzy Hash: 4852A076A10616AFCF468F94DD44D95BBB2BF4C310B0A81D4E6096F236C732E9A5EF40

Function 02652CF7 Relevance: 1.8, Instructions: 1799COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990a4a169e18825fa5556fb07eec02fe781d7d0dd91ccd5c588c4a5c48787b5d
Instruction ID: ccf50a49f9e8d2dd4f03e54320e316e6af8f4dbace2922147376530ec0a8b9d1
Opcode Fuzzy Hash: 990a4a169e18825fa5556fb07eec02fe781d7d0dd91ccd5c588c4a5c48787b5d
Instruction Fuzzy Hash: 35E2D532F002258BCB54AF79D9546ADBAE3AFC5300F4545AED80EEB366DE748D458F80

Function 02652DC8 Relevance: 1.8, Instructions: 1780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515af000c79d561a368ce7d15fe94e33a11475b5ca09f2549bfe815e3582b895
Instruction ID: cb2efd6617d66788f0a18568c73696b9da71e08b9ccb5947ef07c2943b1f85fb
Opcode Fuzzy Hash: 515af000c79d561a368ce7d15fe94e33a11475b5ca09f2549bfe815e3582b895
Instruction Fuzzy Hash: 34E2E532F102258BCB54AF79D9546ADB6E3AFC4300F4585AED80EEB366DE748D458F80

Function 02652D37 Relevance: 1.8, Instructions: 1763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be22d8342a7e2d3fdf3fbed2153ebe70075c9096f753b3b49ef26db0207c5ce7
Instruction ID: 552bd4f44939b06142ef86b1b8ca811194379acfc40369ab5e5d5d268bf68f12
Opcode Fuzzy Hash: be22d8342a7e2d3fdf3fbed2153ebe70075c9096f753b3b49ef26db0207c5ce7
Instruction Fuzzy Hash: 2AE2D532F102258BCB54AF79D9546ADB6E3AFC8300F4545AED80EEB366DE748D458F80

Function 02652D67 Relevance: 1.8, Instructions: 1753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 278f8dabb9b5769f7599bbf795fe5c4162743cb581b6338039e65e1cc51f7674
Instruction ID: f0ccee2e83ec18ce52432935fdae51d5f42cb66c5ca1cef9442640f7c00ae091
Opcode Fuzzy Hash: 278f8dabb9b5769f7599bbf795fe5c4162743cb581b6338039e65e1cc51f7674
Instruction Fuzzy Hash: 44E2D532F102258BCB54AF79D9546ADB6E3AFC8300F4545AED80EEB366DE748D458F80

Function 02652D77 Relevance: 1.7, Instructions: 1745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e61791f70a9d6d2ea83c29606686dfbd4795cfcd46707300036d15a7d7d580
Instruction ID: ce351e8fa9c2faef767b0f9e33d184e3d5ac26239ed89346ae2e6b7a74a4475d
Opcode Fuzzy Hash: 74e61791f70a9d6d2ea83c29606686dfbd4795cfcd46707300036d15a7d7d580
Instruction Fuzzy Hash: 2AE2D532F102258BCB54AF79D9546ADB6E3AFC4300F4545AED80EEB366DE748D458F80

Function 02652D87 Relevance: 1.7, Instructions: 1741COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af890c4591104a1ff15cef818e9b41917f0861ab26431a1534a7b7bdd43e7016
Instruction ID: 77379b6774b0aa4f97141268c034336e40d016a980c65383fae885e957f0767f
Opcode Fuzzy Hash: af890c4591104a1ff15cef818e9b41917f0861ab26431a1534a7b7bdd43e7016
Instruction Fuzzy Hash: F1E2D532F102258BCB54AF79D9546ADB6E3AFC8300F4545AED80EEB366DE748D458F80

Function 02652D47 Relevance: 1.7, Instructions: 1734COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86343c9e6d882cc75deb3d54c7a7f63665fada9fdddc6238bed2c14f172b3276
Instruction ID: 9bdd9cb9daefb5da5eeb30cd75cdafdd0aec037a81312367765a5490bf46b0f6
Opcode Fuzzy Hash: 86343c9e6d882cc75deb3d54c7a7f63665fada9fdddc6238bed2c14f172b3276
Instruction Fuzzy Hash: FBE2D632F102258BCB54AF79D9546ADB6E3AFC4300F4585AED80EEB366DE748D458F80

Function 02652D97 Relevance: 1.7, Instructions: 1734COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a6b2910b5abc93927b1e9f46ef57a9ec61bd2ce5cb7b68ffe6088d4cb79ecf
Instruction ID: 0286cafa46dded15dd0ff9b916a118fe96f2b7de12c6a32f6d68311737ced394
Opcode Fuzzy Hash: c6a6b2910b5abc93927b1e9f46ef57a9ec61bd2ce5cb7b68ffe6088d4cb79ecf
Instruction Fuzzy Hash: 60E2E632F102258BCB54AF79D9546ADB6E3AFC8300F4545AED80EEB366DE748D458F80

Function 04DFF5C0 Relevance: 1.5, APIs: 1, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 04DFF61F

Part of subcall function 04E665A0: NtClose.NTDLL ref: 04E665BF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CloseFileOpen
String ID:
API String ID: 284361766-0
Opcode ID: 32a67d6123a4307eb85fdc09194c47029f1fff63242f7be067f250d755c822ba
Instruction ID: 98b4c83f9b40c34b78799b7e4db65ad5dde0ebb87873f9479637b7fdf36620d6
Opcode Fuzzy Hash: 32a67d6123a4307eb85fdc09194c47029f1fff63242f7be067f250d755c822ba
Instruction Fuzzy Hash: B001A2B1B042106BEA14E7A8CC95B5B33D86F4C719F000918F699E72C4EA74E944CBD6

Function 04E4C350 Relevance: 1.5, APIs: 1, Instructions: 29filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL ref: 04E4C39A

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: 0048ddb49c16115757e8f1410dcebe5c8d5bc76a5152452a0bbe9e5c08f03214
Instruction ID: 2d0b8577e08db67978c5cbfa836b820559bb86f7a729404a55d6bbcd47144b92
Opcode Fuzzy Hash: 0048ddb49c16115757e8f1410dcebe5c8d5bc76a5152452a0bbe9e5c08f03214
Instruction Fuzzy Hash: E9F0BDB62046019FC240DA9DC980D5BBBF9AFCC659F148B1CF55CE3225D634EA918B62

Function 04E4BFF0 Relevance: 1.5, APIs: 1, Instructions: 29filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 04E4C03A

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a23b8f392a50c1ada6cd01fac28056206674cedf29ba309e2088b673b1481cde
Instruction ID: df608fcd0d7f3c87d7078e369a95c6879695fa60287ad997f1874230eadffa80
Opcode Fuzzy Hash: a23b8f392a50c1ada6cd01fac28056206674cedf29ba309e2088b673b1481cde
Instruction Fuzzy Hash: 0DF0BDB52086009FC240DB9DC880D4BBBF9AFCC669F148B1CF55CE3225D634EA918B62

Function 04E4C500 Relevance: 1.5, APIs: 1, Instructions: 27filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL ref: 04E4C545

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ControlFile
String ID:
API String ID: 1795486800-0
Opcode ID: 1db4e37168f2f6f59290021a9df2b284e9f7ddbaa2a4cbb6b5890f95fbc3c71c
Instruction ID: 6acdf18fbf9de962df07d7c518a7041dfeb3c2aa9eec5a0700b003d3e9b25018
Opcode Fuzzy Hash: 1db4e37168f2f6f59290021a9df2b284e9f7ddbaa2a4cbb6b5890f95fbc3c71c
Instruction Fuzzy Hash: 15F0BAB52056009FC240DB5ACA80D1BB7F9AFCCB19F108A9CB15CE3255D634FE118B62

Function 04E4C200 Relevance: 1.5, APIs: 1, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL ref: 04E4C245

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 08f0f82d85b977ebbd5388824650de67f16d7b35c08c0c7e30fc4dbd20d6f7d2
Instruction ID: 437b698c0228c2e70ae93ee95cb579030146911c8fed6e64e4fd710b847a5489
Opcode Fuzzy Hash: 08f0f82d85b977ebbd5388824650de67f16d7b35c08c0c7e30fc4dbd20d6f7d2
Instruction Fuzzy Hash: 16F0BAB52056009FC240DB5ACA80D1BB7F9AFCCB09F108A9CB19CE3255D634FE118B62

Function 04E4C0C0 Relevance: 1.5, APIs: 1, Instructions: 25filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 04E4C100

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b4ab4eecf28c20f663d5e5657161349464704dbda0ee71fa8b8dd615ad378eb5
Instruction ID: eaa6664a9275168b8ed6c4a53a726579206f84f389905149afb3adda2ec2d63f
Opcode Fuzzy Hash: b4ab4eecf28c20f663d5e5657161349464704dbda0ee71fa8b8dd615ad378eb5
Instruction Fuzzy Hash: AAF0C8B52046409FC344DA99C980D1BB7F9BFCC609F148A5CB1DCE3215D638EA118B62

Function 04E4C070 Relevance: 1.5, APIs: 1, Instructions: 25filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL ref: 04E4C0B0

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 53f26f02c1b5c58959579f60040d9bd7c68e30eea908965ffae610e3a4d7c11a
Instruction ID: 5ac6fe84b7c7938179dc5fa037bb2a8885279ad694d0abaacffc7606315e088f
Opcode Fuzzy Hash: 53f26f02c1b5c58959579f60040d9bd7c68e30eea908965ffae610e3a4d7c11a
Instruction Fuzzy Hash: 6BF0C8B52046409FC344DA99C980D1BB7F9BFCC609F148A5CB1DDE3215D639EA118B62

Function 04E4C1C0 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 04E4C1F6

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 5ee3d0ee30ad324c1756ac01181e5d96cf4b50130bdf2975ac3491b1fad9b806
Instruction ID: 7b196da1dc8bb72bc0bfcb30607391edacf9b34f6d71494f4ce8af043e73480a
Opcode Fuzzy Hash: 5ee3d0ee30ad324c1756ac01181e5d96cf4b50130bdf2975ac3491b1fad9b806
Instruction Fuzzy Hash: 82E0FDB56046019FC240DF99C890D4BB7F9AFDC645F10851CB559C3226D634E8468BA1

Function 04E4BA80 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL ref: 04E4BAB6

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: DuplicateObject
String ID:
API String ID: 3677547684-0
Opcode ID: 770a18ad11084eb973916198bc4cdd8fde85832ff5d0aa6553bb3bb3463e902c
Instruction ID: d1765df1bf739777318f0952997dbe13b56ce61bf3ec6fd8620203b212597095
Opcode Fuzzy Hash: 770a18ad11084eb973916198bc4cdd8fde85832ff5d0aa6553bb3bb3463e902c
Instruction Fuzzy Hash: 1AE00AB5204602AFC240DF9DC880D4BBBF9AFEC745F10891CB559D3226D734E986CBA2

Function 04E4BFB0 Relevance: 1.5, APIs: 1, Instructions: 19filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL ref: 04E4BFE1

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 642740972bf9e0f697aa6d9f0f3bfa607118ba45c7536fd524de0611f4355ae0
Instruction ID: debf34378607d4d6d3bc3bcc9e5e801183b4700243fac810beee5213627d27b5
Opcode Fuzzy Hash: 642740972bf9e0f697aa6d9f0f3bfa607118ba45c7536fd524de0611f4355ae0
Instruction Fuzzy Hash: 5DE002B52046029FC240DF59DA80D1BB7F9AFCCA01F108919B159E7225D634ED09DB72

Function 04E4C4C0 Relevance: 1.5, APIs: 1, Instructions: 17filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 04E4C4EC

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID:
API String ID: 634242254-0
Opcode ID: 04660361b98ff8eae3d3d037eddb4678e1dc5050bd83cf8b4b3e4227a1505e37
Instruction ID: 1fc03c2d7553ddedbdcb04b3ae25d5903419966b8190213ae572ef3acfbeb3d1
Opcode Fuzzy Hash: 04660361b98ff8eae3d3d037eddb4678e1dc5050bd83cf8b4b3e4227a1505e37
Instruction Fuzzy Hash: BCE02DB52043429BC240DF99C980D1BB3F9BFCC601F14891CB169D3215C734E8058B62

Function 04E4C110 Relevance: 1.5, APIs: 1, Instructions: 17filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL ref: 04E4C13C

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: 4b4902281e1fb7a5b57456c95ac936febfc30ef0dd93250572c871abafd7967d
Instruction ID: 4cd9d4c6a33a455095058ceb247293be596cc5d052c87e4e2461c793d2032305
Opcode Fuzzy Hash: 4b4902281e1fb7a5b57456c95ac936febfc30ef0dd93250572c871abafd7967d
Instruction Fuzzy Hash: 6AE02DB52053429BC240DF99C980D1BB3E9BFCC605F14891CB1A9D3225C734E8158B62

Function 04E665A0 Relevance: 1.5, APIs: 1, Instructions: 15nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 04E665BF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 391f264cfc88566effa86ea6048a90dcbb0e30f3a0443de849f97f9063f54f63
Instruction ID: 170074aecaf8e8d9fd9d465f0d2b7fe9b81843c8ffef084a44b9d8144bbc48d2
Opcode Fuzzy Hash: 391f264cfc88566effa86ea6048a90dcbb0e30f3a0443de849f97f9063f54f63
Instruction Fuzzy Hash: 7CD017316441028BCA00DB74D981E5573E5FB68741B0485B5E009C7294CA38EC46CB01

Function 04E4C5B0 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtSetSecurityObject.NTDLL ref: 04E4C5D2

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ObjectSecurity
String ID:
API String ID: 2240786066-0
Opcode ID: 14397fa485a07609cf2c6df1e87c9638250e6d99b1f5d169964bb907302802f6
Instruction ID: fa453ef87d5174a4bfa5584fa04246c7f58bbe9b88d09d5d662ec984b90e1ae6
Opcode Fuzzy Hash: 14397fa485a07609cf2c6df1e87c9638250e6d99b1f5d169964bb907302802f6
Instruction Fuzzy Hash: DCD09275204201AFC200DB98C880E0BB7E9FFDC305F10C528B5A8C3229CA34E841CB51

Function 04E4C190 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL ref: 04E4C1B2

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: OpenSection
String ID:
API String ID: 1950954290-0
Opcode ID: 83cf05927a25d33bd873b0157c59824ff41e3edbb1e8d8f07430936a0c90fa19
Instruction ID: c00e2d465db5321b044193f769ff9b005bd2b5dc5aa447fbf817a92e9385117e
Opcode Fuzzy Hash: 83cf05927a25d33bd873b0157c59824ff41e3edbb1e8d8f07430936a0c90fa19
Instruction Fuzzy Hash: 00D09275204201AFC200DB98C884E0BB7E9EFCC305F10C518B56CC3225CA34E841CB61

Function 04E4BCF0 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL ref: 04E4BD12

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e846e0999811f36a60c65f0b2fa6aecb9ca0711abfc11aaeb8d9b90c124c79c6
Instruction ID: e9ee519ddac4f1b549e15cb3d4c82d9c21f91f062dafa6dff0403e4a3ea4d6a3
Opcode Fuzzy Hash: e846e0999811f36a60c65f0b2fa6aecb9ca0711abfc11aaeb8d9b90c124c79c6
Instruction Fuzzy Hash: F2D09275204201AFC200EB98C880E0BB7F9EFCC305F10C519B568C7225CA34E841CB61

Function 04E4C290 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 04E4C2AD

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: b5b44857fded33acac95caa2b8398ab422c098d1221bfc1e30858d41f4e6689c
Instruction ID: 29356a572505e3940cd884e0c6567b8d1697dca471d9ad875ded6a071e8efe23
Opcode Fuzzy Hash: b5b44857fded33acac95caa2b8398ab422c098d1221bfc1e30858d41f4e6689c
Instruction Fuzzy Hash: 52D0CA74200200AFC200EB28CA80E1BB7A9BFC8301B10C628A09893269CA34EC01DB51

Function 04E4C3A0 Relevance: 1.5, APIs: 1, Instructions: 11filenativeCOMMON

Download Yara Rule

APIs

NtQueryAttributesFile.NTDLL ref: 04E4C3BD

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AttributesFileQuery
String ID:
API String ID: 2106648053-0
Opcode ID: 315d2f4b215137869164198c3b3d23eaccac0193b083527b71505ecfacb4e64c
Instruction ID: 44fcc66bb7abb6d2b6b0feaafc82976329e826a05921f87f1081b1e71c89e46f
Opcode Fuzzy Hash: 315d2f4b215137869164198c3b3d23eaccac0193b083527b71505ecfacb4e64c
Instruction Fuzzy Hash: 9ED0CA78205200ABC200EB28CA80E1BB7A9AFCC301B10C568A09883229CA38EC029A11

Function 04E4BA50 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 04E4BA6C

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 173d9df2f36c615babb380dcdc769afc829321b60351e30f78627e5af1b1180c
Instruction ID: cb3947ef6e188f07c0de6b6ec190446bbcbaabfd86d3c722d2c26e426ba35679
Opcode Fuzzy Hash: 173d9df2f36c615babb380dcdc769afc829321b60351e30f78627e5af1b1180c
Instruction Fuzzy Hash: 3BC012706042008BC200EB68C984A0A73A5EBAC341F008028A01C87206CA38FC02CA00

Function 04E377C0 Relevance: 61.9, APIs: 25, Strings: 10, Instructions: 690
filesynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00000020), ref: 04E377E4
GetCurrentThreadId.KERNEL32 ref: 04E377F8
GetCurrentProcessId.KERNEL32 ref: 04E3780A
OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 04E37818
wsprintfW.USER32 ref: 04E3785B
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 04E3786C
wsprintfW.USER32 ref: 04E378D3
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 04E378E4
OpenMutexW.KERNEL32(00100000,?,?), ref: 04E37924
wsprintfW.USER32 ref: 04E37978
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 04E37989
OpenMutexW.KERNEL32(00100000,?,?), ref: 04E379CB
wsprintfW.USER32 ref: 04E37A35
CreateFileMappingW.KERNELBASE(000000FF,04EC8968,00000004,00000000,00210CF0,?), ref: 04E37A5B
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,00210CF0,00000000), ref: 04E37AD5
GetCurrentProcessId.KERNEL32(?,?,00000006,00000000,00000000,00210CF0,00000000), ref: 04E37BC7
CreateFileMappingW.KERNELBASE(000000FF,04EC8968,00000004,00000000,00100000,?,00000006,00000000,00000000,00210CF0,00000000), ref: 04E37BF5
OpenFileMappingW.KERNEL32(00000006,00000000,?,00000000), ref: 04E37C10
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,00100000,?,00000000), ref: 04E37C3F
wsprintfW.USER32 ref: 04E37C96
OpenFileMappingW.KERNEL32(000F001F,00000000,?,?,?,?,00100000,?,00000000), ref: 04E37CAE
MapViewOfFile.KERNEL32(?,00000006,00000000,00000000,?,?,?,?,00100000,?,00000000), ref: 04E37CD0
GetCurrentProcessId.KERNEL32(?,00000006,00000000,00000000,00100000,?,00000000), ref: 04E37CF5

Part of subcall function 04E93F10: RtlZeroMemory.NTDLL(00000000,00000008), ref: 04E93F1A

Part of subcall function 04E91930: GetSystemInfo.KERNELBASE(759216C0,759216C0,7591F3C0,7591F550,?,?,?,?,04E9108F,00000000,01000000,00000400,00000000), ref: 04E9195D

GetModuleHandleW.KERNEL32(bxsdk32.dll,?,00000006,00000000,00000000,00100000,?,00000000), ref: 04E37DE6

Part of subcall function 04E53930: GetModuleFileNameW.KERNEL32(?,00000000,00000001,00000000,04DC0000,?,00000000), ref: 04E53963
Part of subcall function 04E53930: GetModuleFileNameW.KERNEL32(?,00000000,-00000100), ref: 04E539B1

Part of subcall function 04E53B20: lstrlenW.KERNEL32(?,?,?,?,00000000,04E2F728,?,?,?,?), ref: 04E53B2F
Part of subcall function 04E53B20: lstrcpyW.KERNEL32(00000000,?), ref: 04E53B5A
Part of subcall function 04E53B20: lstrlenW.KERNEL32(00000000,?,00000000,04E2F728,?,?,?,?), ref: 04E53B61

Part of subcall function 04DFF070: memcpy.NTDLL(00000000,?,?,00000000,00000000,00000000,00000000,000000AC,00000FA0,?,?,_CLASSES\Wow6432Node\CLSID,\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID,\REGISTRY\MACHINE\Software\Classes\Wow6432Node\AppID,\REGISTRY\MACHINE\Software\Wow6432Node,00000030), ref: 04DFF10C
Part of subcall function 04DFF070: memcpy.NTDLL(?,?,00000002,00000000,?,?,00000000,00000000,00000000,00000000,000000AC,00000FA0,?,?,_CLASSES\Wow6432Node\CLSID,\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID), ref: 04DFF11A

Part of subcall function 04E35FC0: GetFileAttributesW.KERNELBASE(?,04E7A507,?), ref: 04E35FC5

OpenFileMappingW.KERNEL32(00000006,00000000,?,00000000), ref: 04E37A77

Part of subcall function 04E665A0: NtClose.NTDLL ref: 04E665BF

Strings

boxedapp_shared_mem, xrefs: 04E37C5E
bxsdk64.dll, xrefs: 04E37E29, 04E37F3D
%s_%.8x, xrefs: 04E37C90
boxedapp_shared_env_mutex, xrefs: 04E37849
boxedapp_process_shared_mem_info, xrefs: 04E37BCE
boxedapp_global_shared_mem, xrefs: 04E37966
bxsdk32.dll, xrefs: 04E37DE1, 04E37EE3
%s_%.8x_%.8x, xrefs: 04E37855, 04E378CD, 04E37972, 04E37A2F
boxedapp_shared_env, xrefs: 04E37A23
boxedapp_process_list_mutex, xrefs: 04E378C1

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: File$Open$CreateCurrentMappingMutexProcesswsprintf$ModuleView$Namelstrlenmemcpy$AttributesCloseHandleInfoMemorySystemThreadZerolstrcpy
String ID: %s_%.8x$%s_%.8x_%.8x$boxedapp_global_shared_mem$boxedapp_process_list_mutex$boxedapp_process_shared_mem_info$boxedapp_shared_env$boxedapp_shared_env_mutex$boxedapp_shared_mem$bxsdk32.dll$bxsdk64.dll
API String ID: 1941339701-2879591448
Opcode ID: 5f583a24e78498094160073a38a072bd554cdf6d864e4476c3a181daab1f4757
Instruction ID: 8b081e39151fe16ecf5f293fb645bcd82a51c3d476fbd46b43a39131011483dd
Opcode Fuzzy Hash: 5f583a24e78498094160073a38a072bd554cdf6d864e4476c3a181daab1f4757
Instruction Fuzzy Hash: 103292B16043019BE725EB64DC85FABB3E9EF84709F044A1DF54697281EB70F905CBA2

Function 04DDB9D0 Relevance: 31.5, APIs: 2, Strings: 15, Instructions: 1756COMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(?,00000000,00000000,00000000), ref: 04DDBA8A

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

Strings

BoxedApp::FileSystem::CFileSystem::CreateVirtualFile, xrefs: 04DDBA0A, 04DDC445, 04DDC79B, 04DDCC33, 04DDCD1B, 04DDCDD1
, found path component: ", xrefs: 04DDCC2E
, passed pBehavior returns FILE_ATTRIBUTE_DIRECTORY attribute, but it's requested to create not a directory, xrefs: 04DDCDCC
(name=", xrefs: 04DDC988, 04DDC9A9
", id=, xrefs: 04DDC978, 04DDC99C
, szPath: ", xrefs: 04DDBA05
core, xrefs: 04DDBA0F, 04DDC1FA, 04DDC44A, 04DDC7A0, 04DDC9AE, 04DDCB87, 04DDCC38, 04DDCD20, 04DDCDD6
-> , xrefs: 04DDC98D
, RtlDosPathNameToNtPathName_U returns FALSE for path: ", xrefs: 04DDC796
", which is invalid file name, going to SetLastError(ERROR_INVALID_NAME) and return INVALID_HANDLE_VALUE, xrefs: 04DDCC21
, passed pBehavior doesn't return FILE_ATTRIBUTE_DIRECTORY attribute, but it's requested to create a directory, xrefs: 04DDC440
It's impossible to create sub file of non directory virtual file, xrefs: 04DDCB82
It's impossible to create virtual file: passed pBehavior doesn't support Behavior::IVirtualFileStream, xrefs: 04DDC1F5
, passed pBehavior doesn't support IVirtualFile, xrefs: 04DDCD16
", going to set SetLastError(ERROR_INVALID_NAME) and return INVALID_HANDLE_VALUE, xrefs: 04DDC790

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CurrentPath$FileLocalNameName_PrintProcessThreadTimeWrite
String ID: -> $", going to set SetLastError(ERROR_INVALID_NAME) and return INVALID_HANDLE_VALUE$", id=$", which is invalid file name, going to SetLastError(ERROR_INVALID_NAME) and return INVALID_HANDLE_VALUE$(name="$, RtlDosPathNameToNtPathName_U returns FALSE for path: "$, found path component: "$, passed pBehavior doesn't return FILE_ATTRIBUTE_DIRECTORY attribute, but it's requested to create a directory$, passed pBehavior doesn't support IVirtualFile$, passed pBehavior returns FILE_ATTRIBUTE_DIRECTORY attribute, but it's requested to create not a directory$, szPath: "$BoxedApp::FileSystem::CFileSystem::CreateVirtualFile$It's impossible to create sub file of non directory virtual file$It's impossible to create virtual file: passed pBehavior doesn't support Behavior::IVirtualFileStream$core
API String ID: 2358008889-2641446209
Opcode ID: 2cd7bec7c089d72419faff95d42305c8a4d38383d121dd502cab914d2830c662
Instruction ID: 6b8df0cbe2b467f931ffafcc4d4a09aad8614c6923183c18bf03032998c224bb
Opcode Fuzzy Hash: 2cd7bec7c089d72419faff95d42305c8a4d38383d121dd502cab914d2830c662
Instruction Fuzzy Hash: F8E228756042419FD724EF68C890DAEB3E9BFC8704F15896DE28A87290DB31FD45CB92

Function 04E38090 Relevance: 30.2, APIs: 13, Strings: 4, Instructions: 413
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 04E38285
wsprintfW.USER32 ref: 04E382A5
CreateFileMappingW.KERNELBASE(000000FF,04EC8968,00000004,00000000,000100FF,?), ref: 04E382C2
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,000100FF), ref: 04E382E3

Part of subcall function 04E91930: GetSystemInfo.KERNELBASE(759216C0,759216C0,7591F3C0,7591F550,?,?,?,?,04E9108F,00000000,01000000,00000400,00000000), ref: 04E9195D

GetCurrentProcessId.KERNEL32(?,?,00000006,00000000,00000000,000100FF), ref: 04E383AC
OpenProcess.KERNEL32(00000048,00000000,?,?,?,00000006,00000000,00000000,000100FF), ref: 04E383BF
wsprintfW.USER32 ref: 04E383FB
wsprintfW.USER32 ref: 04E38417
OpenFileMappingW.KERNEL32(000F001F,00000000,?), ref: 04E3842F
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00100000), ref: 04E3844B

Strings

boxedapp_shared_mem, xrefs: 04E38273
%s_%.8x, xrefs: 04E3829F, 04E38411
boxedapp_process_shared_mem_info, xrefs: 04E383E9
%s_%.8x_%.8x, xrefs: 04E3827F, 04E383F5

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Filewsprintf$MappingOpenProcessView$CreateCurrentInfoSystem
String ID: %s_%.8x$%s_%.8x_%.8x$boxedapp_process_shared_mem_info$boxedapp_shared_mem
API String ID: 3975798447-3253204589
Opcode ID: cc7c0a3542aed7e87aa60e371be032f66daea9ca01360d300d3624bb882931ec
Instruction ID: f3921e9d27ef5f4caca9da170c13c8156073cd784f10e86e863472bc73794856
Opcode Fuzzy Hash: cc7c0a3542aed7e87aa60e371be032f66daea9ca01360d300d3624bb882931ec
Instruction Fuzzy Hash: B3E18EB16043019FD714DF29D884B6BB7E5FB88319F049A2DF94997280EB75EC05CBA2

Function 04E34940 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 194
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 04E34978
CreateFileMappingW.KERNELBASE(000000FF,04EC8968,00000004,00000000,00000004,?), ref: 04E34999
OpenFileMappingW.KERNEL32(00000006,00000000,?), ref: 04E349AA
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,00000004), ref: 04E349E1
GetCurrentProcessId.KERNEL32(?), ref: 04E34A02
CreateFileMappingW.KERNELBASE(000000FF,04EC8968,00000004,00000000,00000018,?), ref: 04E34A2C
MapViewOfFile.KERNELBASE(?,00000006,00000000,00000000,00000018), ref: 04E34A4E
GetCurrentProcessId.KERNEL32(?), ref: 04E34A77
CreateEventW.KERNEL32(00000000,00000000,00000000,?), ref: 04E34A9D
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 04E34AB3
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 04E34AC0

Strings

boxedapp_msg_process, xrefs: 04E34A0D
boxedapp_msg_global, xrefs: 04E34969
%s_%.8x_%.8x, xrefs: 04E34972
boxedapp_event_newmsg, xrefs: 04E34A82

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CreateFile$EventMapping$CurrentProcessView$Openwsprintf
String ID: %s_%.8x_%.8x$boxedapp_event_newmsg$boxedapp_msg_global$boxedapp_msg_process
API String ID: 3896030162-1607731783
Opcode ID: 91831a5e7142b4e1562698e805b5338283a2a86fdacbfed55159c979290be703
Instruction ID: d58c8ce15d0520513a25ccc5e68f4865a43c7274e8e99f6c1209f931d07b07dc
Opcode Fuzzy Hash: 91831a5e7142b4e1562698e805b5338283a2a86fdacbfed55159c979290be703
Instruction Fuzzy Hash: 2751C0B26003046BD360EF29DC45F6BB7ECEB84759F040A2DF185D6281EA71F809CBA5

Function 04E81150 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 367
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

TlsGetValue.KERNEL32(00000014), ref: 04E81166
lstrcmpiA.KERNEL32(00000000), ref: 04E81240

Part of subcall function 04E30AE0: GetLastError.KERNEL32(00000000,04E66E83,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AE3
Part of subcall function 04E30AE0: SetLastError.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AEE

Strings

8d7c89fa-47cf-4cc6-a8d1-bd687a513c04, xrefs: 04E81238
CBoxedAppCore::My_NtCreateFile, szPath: , xrefs: 04E81290, 04E81458
, status: , xrefs: 04E814D4
, ShareAccess: , xrefs: 04E81310, 04E8150B
, DesiredAccess: , xrefs: 04E81320, 04E8151E
, OpenOptions: , xrefs: 04E812E9, 04E814E4
core, xrefs: 04E81295, 04E8145D
, handle: , xrefs: 04E814C1
, CreateDisposition: , xrefs: 04E812F9, 04E814F4

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$Valuelstrcmpi
String ID: , CreateDisposition: $, DesiredAccess: $, OpenOptions: $, ShareAccess: $, handle: $, status: $8d7c89fa-47cf-4cc6-a8d1-bd687a513c04$CBoxedAppCore::My_NtCreateFile, szPath: $core
API String ID: 1002481624-2342742713
Opcode ID: 8bf4c76e6fbc68b58ffed539ce2bf8b09b09802585ee0e212e12e8be2a3e63ee
Instruction ID: d0fedaa2def2d2b2dddb697e5c5d8b27d5308afed6114ba2cee3c5568368d71a
Opcode Fuzzy Hash: 8bf4c76e6fbc68b58ffed539ce2bf8b09b09802585ee0e212e12e8be2a3e63ee
Instruction Fuzzy Hash: F2D110B1A04350AFEA14EF64D840E5FB7E9AFC8B08F005D2DB589D7250EA74FD058B92

Function 04E8DF80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53
filelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,?,00000000), ref: 04E8DF91
MapViewOfFile.KERNELBASE(00000000,00000002,00000000,00000000,?), ref: 04E8DFAB
GetModuleHandleW.KERNEL32(ntdll.dll,RtlMoveMemory), ref: 04E8DFC1
GetProcAddress.KERNEL32(00000000), ref: 04E8DFC8
UnmapViewOfFile.KERNEL32(00000000), ref: 04E8DFD8
CloseHandle.KERNEL32(00000000), ref: 04E8DFE3

Strings

ntdll.dll, xrefs: 04E8DFBC
RtlMoveMemory, xrefs: 04E8DFB7

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: File$HandleView$AddressCloseCreateMappingModuleProcUnmap
String ID: RtlMoveMemory$ntdll.dll
API String ID: 3734750734-3196484093
Opcode ID: fdfe5eb90b3f274b76c223cb53e9128e4878bf6512d7754394feab8a65d32e60
Instruction ID: 10778638b9ddbf06893b8b9ac48a38b705d37440e7254e255a243edb1ca0ec17
Opcode Fuzzy Hash: fdfe5eb90b3f274b76c223cb53e9128e4878bf6512d7754394feab8a65d32e60
Instruction Fuzzy Hash: 2E01D6333806207BE6206A66BC89F6B679DEBD4B77F108117F614D61C0CB69AC018635

Function 04DD1370 Relevance: 13.7, APIs: 9, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04DC8EF0: InterlockedExchange.KERNEL32(00000008,00000000), ref: 04DC8F38
Part of subcall function 04DC8EF0: InterlockedDecrement.KERNEL32(0000000C), ref: 04DC8F49
Part of subcall function 04DC8EF0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DC8F5B

GetCurrentProcess.KERNEL32 ref: 04E9849D
OpenProcessToken.ADVAPI32(00000000), ref: 04E984A4
GetTokenInformation.KERNELBASE(00000008,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 04E984D0
GetTokenInformation.KERNELBASE(00000008,TokenIntegrityLevel,?,?,?,?), ref: 04E984F9

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Token$InformationInterlockedProcess$CurrentDecrementExchangeOpenReleaseSemaphore
String ID:
API String ID: 2721379685-0
Opcode ID: 4db13de48d38b53dbb6242e5e062c297222c27c3e59f6226ae2ca459351b0f10
Instruction ID: 71f80b03bfa8bdf8d84dc607b36c61b19e3647be2d5836ab5c4eb7c9a55c5d6d
Opcode Fuzzy Hash: 4db13de48d38b53dbb6242e5e062c297222c27c3e59f6226ae2ca459351b0f10
Instruction Fuzzy Hash: 2F516FB2604301ABD704EF15DC80EABB3E8FBC9218F04492DF54697280E734ED09CBA2

Function 04E51440 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(04EC8904,00000001,00000000), ref: 04E51449
HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,00000000,?), ref: 04E51457
LoadLibraryW.KERNEL32(ntdll.dll,?,?,00000000,?), ref: 04E51467
GetProcAddress.KERNEL32(00000000,RtlUpcaseUnicodeChar), ref: 04E51473
RtlUpcaseUnicodeChar.NTDLL(00000000), ref: 04E51493

Strings

RtlUpcaseUnicodeChar, xrefs: 04E5146D
ntdll.dll, xrefs: 04E5145D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AddressCharCompareCreateExchangeHeapInterlockedLibraryLoadProcUnicodeUpcase
String ID: RtlUpcaseUnicodeChar$ntdll.dll
API String ID: 455295019-4040803293
Opcode ID: 36535c4ba5220db3439030d49bd97cf65d9569bf3ce3623f5cdcd9bb141e6c70
Instruction ID: 3166f47c6930f205cc29c4e247f009fb9d73712d269c7edf28c1361545f1e246
Opcode Fuzzy Hash: 36535c4ba5220db3439030d49bd97cf65d9569bf3ce3623f5cdcd9bb141e6c70
Instruction Fuzzy Hash: 63F090729403307BDB106F72FD0DF9A3A56FB04747F815026F915D6188DA7D6C428B91

Function 04E7DB90 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 151
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

LdrLoadDll.NTDLL ref: 04E7DBE2
DeactivateActCtx.KERNEL32(00000000,?), ref: 04E7DC3C

Strings

LdrLoadDll: ", xrefs: 04E7DCAA
, base = , xrefs: 04E7DC79
", status = , xrefs: 04E7DC8D
core, xrefs: 04E7DCAF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: DeactivateErrorLastLoad
String ID: ", status = $, base = $LdrLoadDll: "$core
API String ID: 451580975-1347681879
Opcode ID: 3da91a07fc79a5ff16fc166b4f02398008d2d5e4bdb5260f293821cec864c593
Instruction ID: 998ac2c4f4f37f90e1d547dd3308961517a67b6ee02ae518f67387058cd5c79d
Opcode Fuzzy Hash: 3da91a07fc79a5ff16fc166b4f02398008d2d5e4bdb5260f293821cec864c593
Instruction Fuzzy Hash: 00517C71604300ABDB04EF65DC90D6BB7E9EFC5219F04293CF58697291EA74FD05CAA2

Function 04E50EF0 Relevance: 10.6, APIs: 7, Instructions: 111threadmemorysynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E50EFF
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 04E50F5A
CreateMutexW.KERNELBASE(00000000,00000001,00000000), ref: 04E50FCC
CloseHandle.KERNEL32(?), ref: 04E50FE7
GetCurrentThreadId.KERNEL32 ref: 04E51001
OpenThread.KERNEL32(00100000,00000000,00000000), ref: 04E5100E
CloseHandle.KERNEL32(?), ref: 04E51023

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Thread$CloseCurrentHandle$AllocCreateMutexOpenVirtual
String ID:
API String ID: 3714206927-0
Opcode ID: cb6ae7e0151b10b0e2fda2aefe59d44e3876db34515388f5188356c99289fd23
Instruction ID: 7133b9617a03be83f3717816fc5d45886c02af35f05ddbf305c8f50b3517499f
Opcode Fuzzy Hash: cb6ae7e0151b10b0e2fda2aefe59d44e3876db34515388f5188356c99289fd23
Instruction Fuzzy Hash: C24128B19007019FC360DF2AD880916FBF5FF98365B548A2EF99AC37A1D770E9058B51

Function 0043AE1D Relevance: 9.1, APIs: 6, Instructions: 107threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0043F83D: TlsGetValue.KERNEL32(?,0043AE22), ref: 0043F844
Part of subcall function 0043F83D: TlsSetValue.KERNEL32(00000000,0043AE22), ref: 0043F865

Part of subcall function 0043F822: TlsGetValue.KERNEL32(?,0043AE2D,00000000), ref: 0043F82C

GetLastError.KERNEL32(00000000,?,00000000), ref: 0043AE44
ExitThread.KERNEL32 ref: 0043AE4B
CreateThread.KERNELBASE(00000000,?,0043AE1D,00000000,00000004,00000000), ref: 0043AF03
ResumeThread.KERNELBASE(00000000,?,?,?,?,?,?,00000000), ref: 0043AF13
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 0043AF1E
__dosmaperr.LIBCMT ref: 0043AF36

Memory Dump Source

Source File: 00000009.00000002.2755614298.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2755550332.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755670835.0000000000452000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755732116.000000000046B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.000000000046D000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000570000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000576000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000583000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756191692.000000000059F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756263555.00000000005A3000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000762000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000907000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ThreadValue$ErrorLast$CreateExitResume__dosmaperr
String ID:
API String ID: 1421997792-0
Opcode ID: e5201e6d34afa2921fc95f946d628e313e99d21ffcb5b2ebc4f54ad5e8e98abb
Instruction ID: 8f8596a89a85ecec8b4a3dc895ae1eaea928c96a511ba3fcb1bd314a5cbd4c28
Opcode Fuzzy Hash: e5201e6d34afa2921fc95f946d628e313e99d21ffcb5b2ebc4f54ad5e8e98abb
Instruction Fuzzy Hash: 173122B1841300AFD718BF729D4A95F7BA4EF4C329F20563FF554922A2DB78C8058A5E

Function 04E65880 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 04E93F30: RtlMoveMemory.NTDLL(?,?,00000000), ref: 04E93F3F

GetSystemInfo.KERNELBASE(?,?,?,00000000), ref: 04E658A1

Part of subcall function 04E93F10: RtlZeroMemory.NTDLL(00000000,00000008), ref: 04E93F1A

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,00000000), ref: 04E658C1

Part of subcall function 04E97E30: VirtualAlloc.KERNELBASE(00000000,00000005,00001000,?,04E65A9B,?,00000005,00000040,?,?,?,?,00000000), ref: 04E97E41

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04E659F0
FlushInstructionCache.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04E659F7

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: MemoryVirtual$AllocCacheCurrentFlushInfoInstructionMoveProcessQuerySystemZero
String ID:
API String ID: 3732356899-0
Opcode ID: 3e20df5fcc24e237b7c0df0e677b93dc5fcbc5e4d8bdd07d7db30eb67866c228
Instruction ID: 0818e25e68c772ab2f7c28be92448dd9eba4967d52e8af396e68ea1971394e9b
Opcode Fuzzy Hash: 3e20df5fcc24e237b7c0df0e677b93dc5fcbc5e4d8bdd07d7db30eb67866c228
Instruction Fuzzy Hash: EC4164B2554741AFD320DF79DC44E5BB7E9EB88214F004A1DF99A83285EB74E9088BA1

Function 04DDD7B0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 04DDD888
GetCurrentProcess.KERNEL32(?,00000000), ref: 04DDD890
DuplicateHandle.KERNEL32(00000000), ref: 04DDD893
CloseHandle.KERNEL32(?), ref: 04DDD8DB

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicate
String ID:
API String ID: 1410216518-0
Opcode ID: d848ba057bb9000c92f9608641793875cd2c97602752065d85a12bfde942a4d5
Instruction ID: 117d451bede257d958290ca795583eba72b092ceef6b77a0a126d71cdf299387
Opcode Fuzzy Hash: d848ba057bb9000c92f9608641793875cd2c97602752065d85a12bfde942a4d5
Instruction Fuzzy Hash: D341E676208344AFD755DFA9C8C0D6BB3EAFB88314F144A2DF65A83251DB31E905CB62

Function 04E05E80 Relevance: 6.1, APIs: 4, Instructions: 108threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,04EC8954,7591F550,7508EB20,7508ED30,?,?,?,?,04E05FBF), ref: 04E05F19
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,04E05FBF,?,?,?,7591F550,04E918F5), ref: 04E05F43
InterlockedIncrement.KERNEL32(00000004), ref: 04E05F64
CreateThread.KERNELBASE(00000000,00000000,04E05E60,00000000,00000000,0000000C), ref: 04E05F77

Part of subcall function 04E665A0: NtClose.NTDLL ref: 04E665BF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Create$Event$CloseIncrementInterlockedThread
String ID:
API String ID: 4199909435-0
Opcode ID: f1c458a6af2640e7cd5849367a933f0a52475d08ec6d7d9ae54d96a25d29d8f6
Instruction ID: c80295e07d3f45bd0b5916e9c679fb8dba1b4266f406b7a8f2c15287387adc2e
Opcode Fuzzy Hash: f1c458a6af2640e7cd5849367a933f0a52475d08ec6d7d9ae54d96a25d29d8f6
Instruction Fuzzy Hash: 9C41C3B0904B019F8320CF2A9984817FBF9FFD9754B504A1FE4AAC3AA0D774E5458BA5

Function 04E14A80 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8EF0: InterlockedExchange.KERNEL32(00000008,00000000), ref: 04DC8F38
Part of subcall function 04DC8EF0: InterlockedDecrement.KERNEL32(0000000C), ref: 04DC8F49
Part of subcall function 04DC8EF0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DC8F5B

GetCurrentProcess.KERNEL32 ref: 04E9849D
OpenProcessToken.ADVAPI32(00000000), ref: 04E984A4
GetTokenInformation.KERNELBASE(00000008,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 04E984D0
GetTokenInformation.KERNELBASE(00000008,TokenIntegrityLevel,?,?,?,?), ref: 04E984F9

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Token$InformationInterlockedProcess$CurrentDecrementExchangeOpenReleaseSemaphore
String ID:
API String ID: 2721379685-0
Opcode ID: 4d28243348eabe2ae5c2a6f93e261b13ec004f56f2cc1d4bdc24832683cf8c46
Instruction ID: 2492f1ba6a4454f0b16cf6991fd04d1087409b4a1f8758fd044695fe559f7817
Opcode Fuzzy Hash: 4d28243348eabe2ae5c2a6f93e261b13ec004f56f2cc1d4bdc24832683cf8c46
Instruction Fuzzy Hash: 93216FB6604201AFD704DA15DC84F6BB7E9FBC9718F04851DF54987290EB35ED098BA2

Function 04E977B0 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(04E34CB9,?,00000040,?,?,?,?,?,04E35DC2,?,?,?,?,00000000,?,04E34CB9), ref: 04E977CB

Part of subcall function 04E93F30: RtlMoveMemory.NTDLL(?,?,00000000), ref: 04E93F3F

VirtualProtect.KERNELBASE(04E34CB9,?,?,?,?,00000000,?,?,?,?,04E8FA2D), ref: 04E977E8
GetCurrentProcess.KERNEL32(04E34CB9,?,?,00000000,?,?,?,?,04E8FA2D), ref: 04E977EC
FlushInstructionCache.KERNEL32(00000000,?,00000000,?,?,?,?,04E8FA2D), ref: 04E977F3

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ProtectVirtual$CacheCurrentFlushInstructionMemoryMoveProcess
String ID:
API String ID: 596428666-0
Opcode ID: 4001557c6b5b3639e06e03b17272d4b65ca4ebca80ec27abe9565f20f36aba8f
Instruction ID: d42c2c22ba01cd6702d84f952c8d7feb4cec86979fcc0ee8fa5ead95340deb5e
Opcode Fuzzy Hash: 4001557c6b5b3639e06e03b17272d4b65ca4ebca80ec27abe9565f20f36aba8f
Instruction Fuzzy Hash: D4F0FE721051117F9600DB56EC88DBFBBADEFCA665F00440EF64993141D674AC0687B6

Function 0043ADDC Relevance: 4.5, APIs: 3, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0043F9FB: __amsg_exit.LIBCMT ref: 0043FA09

CloseHandle.KERNEL32(?), ref: 0043ADC6
__freeptd.LIBCMT ref: 0043ADCD
ExitThread.KERNEL32 ref: 0043ADD5

Part of subcall function 0043FDB0: __FindPESection.LIBCMT ref: 0043FE09

Memory Dump Source

Source File: 00000009.00000002.2755614298.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2755550332.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755670835.0000000000452000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755732116.000000000046B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.000000000046D000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000570000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000576000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000583000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756191692.000000000059F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756263555.00000000005A3000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000762000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000907000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CloseExitFindHandleSectionThread__amsg_exit__freeptd
String ID:
API String ID: 1262231458-0
Opcode ID: b23d0af45d41ee54e17b61858cfc5b22db630a960199009171090f466a26fffd
Instruction ID: 86bd6b700fd1742491bf267ee1f7a06fa6d34f24a60a48abfe277de77b901c7b
Opcode Fuzzy Hash: b23d0af45d41ee54e17b61858cfc5b22db630a960199009171090f466a26fffd
Instruction Fuzzy Hash: 8DF0BE31941601EBD7146BA49A0DB6E3722AF0D717F64212BF242855E2CBACC809865E

Function 04DC4920 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000001,?), ref: 04DC4A6B

Strings

, xrefs: 04DC4A5C

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 0613eba591deff784bc3b1f8d58ddb3a578b105d1938874b57411f7a73fe9fc9
Instruction ID: 12b43e6b8d6dda6391fd73ac363ad557de21b2e3fc08861b867c8d1b5b0b8d43
Opcode Fuzzy Hash: 0613eba591deff784bc3b1f8d58ddb3a578b105d1938874b57411f7a73fe9fc9
Instruction Fuzzy Hash: 174103726043228FE314CF09C850B6AB3E5FF85308F04862DEA859B391EB76F915CB91

Function 04E509C0 Relevance: 3.0, APIs: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 04E509CD
CreateThread.KERNELBASE(00000000,00000000,Function_000908D0,?,00000000,?), ref: 04E50A06

Part of subcall function 04E665A0: NtClose.NTDLL ref: 04E665BF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Create$CloseEventThread
String ID:
API String ID: 3538138673-0
Opcode ID: 0bb6f35463eb2abc36169b55e201363a2de923de8c8ec9f44acca5dd2f0a1037
Instruction ID: 2e28a90336d237b47b1f4289d993caefae3a8067442f7ce674a77c77c02961a7
Opcode Fuzzy Hash: 0bb6f35463eb2abc36169b55e201363a2de923de8c8ec9f44acca5dd2f0a1037
Instruction Fuzzy Hash: B001D13035070066F6309F369C49F1376E8DB80B68F241B2AFE41D61E0EA70F40986A0

Function 04E65CA0 Relevance: 3.0, APIs: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,04E86596,80000000,?,00000001,AppId\,00000000,00000000,?,?), ref: 04E65CAB
RegOpenKeyExW.KERNELBASE(04E86596,04E86596,00000000,?,00000001,?,?,04E86596,80000000,?,00000001,AppId\,00000000,00000000,?,?), ref: 04E65CCD

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 33e00293bc940a49b2f9a7290206062aa1fd104cade7db0245210622742b37d9
Instruction ID: dfaf0502dace5d0c3f8d5a3889aad6e6a01b8deb515ce0095404949a09a7d31a
Opcode Fuzzy Hash: 33e00293bc940a49b2f9a7290206062aa1fd104cade7db0245210622742b37d9
Instruction Fuzzy Hash: 8EF0C9B1658312AFD724CF64E849E27B3EDEB98741F20491EB496D3280DB74EC05DBA1

Function 04E93FA0 Relevance: 3.0, APIs: 2, Instructions: 28memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E93FBF
RtlAllocateHeap.NTDLL(02D20000,00000001,?,0000000C,04EC8948,04EC8944,?,00000000,0000000C,04E3062D,?,00000000,04DC272E,?,00000000), ref: 04E93FEA

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AllocateCurrentHeapThread
String ID:
API String ID: 3014162906-0
Opcode ID: 983e3e93613db5ee104c9b9154217b799d5d6a6af806c9814335142b90b05ac7
Instruction ID: 650c04384f2e43d2916ab4682f84e43c9587c8c38c995d63808eb0d933afa03a
Opcode Fuzzy Hash: 983e3e93613db5ee104c9b9154217b799d5d6a6af806c9814335142b90b05ac7
Instruction Fuzzy Hash: 7EF0B4306042109BD714FF16D988BAA37E1FB4431BF40111CF448561C4CB79AD46CF92

Function 04E50E10 Relevance: 3.0, APIs: 2, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E50E24
RtlQueueApcWow64Thread.NTDLL(?,Function_00090CF0,00000000,00000000,00000000), ref: 04E50E48

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Thread$CurrentQueueWow64
String ID:
API String ID: 829397326-0
Opcode ID: 96c80e8849d7db1c866ae1a7ad4f03a034613f272f49a1b99101253847a184a8
Instruction ID: 5c763d3c8571482fcc29aa73f435104f7bfd7fe1549ad6d139bd1983c5d97566
Opcode Fuzzy Hash: 96c80e8849d7db1c866ae1a7ad4f03a034613f272f49a1b99101253847a184a8
Instruction Fuzzy Hash: D4E09272641321AFD2305B26ED05F87FBE4EB84B11F11892AFD4597290CA74B841C7A5

Function 04E50CB0 Relevance: 3.0, APIs: 2, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E50CC4
RtlQueueApcWow64Thread.NTDLL(?,Function_00090950,00000000,00000000,00000000), ref: 04E50CE1

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Thread$CurrentQueueWow64
String ID:
API String ID: 829397326-0
Opcode ID: 6da106973009a0fed2bdc7d37796c16f7d01eb9bb44ded0ef8dd393ab7a09a8f
Instruction ID: bba50fdc7b7412e848ad99bc3f43592850a1b808772e2a92ce578392df7f3731
Opcode Fuzzy Hash: 6da106973009a0fed2bdc7d37796c16f7d01eb9bb44ded0ef8dd393ab7a09a8f
Instruction Fuzzy Hash: 28E02632642221B7D2301B62BC08F87BAA4EF85B12F010426FD01B7280CAB4BC01C7E1

Function 04E91930 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(759216C0,759216C0,7591F3C0,7591F550,?,?,?,?,04E9108F,00000000,01000000,00000400,00000000), ref: 04E9195D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c7c487f99afaa5878a9ccf038ff6593d7e4e36aaf8df246f2d9d7fc6ebdf8f85
Instruction ID: b8e9dcf846666cff8bbe777920adfd6f93a5a72bce00d0d04554d1d8e4eefc92
Opcode Fuzzy Hash: c7c487f99afaa5878a9ccf038ff6593d7e4e36aaf8df246f2d9d7fc6ebdf8f85
Instruction Fuzzy Hash: 47218071B047114FEB18CE2EC89025AF7E6BFC9218F44963EE486C7798E635ED858640

Function 04E341E0 Relevance: 1.5, APIs: 1, Instructions: 41threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000741D0,?,00000000,?), ref: 04E341F7

Part of subcall function 04E33970: InterlockedExchange.KERNEL32(?,00000000), ref: 04E33B03

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CreateExchangeInterlockedThread
String ID:
API String ID: 250680929-0
Opcode ID: 17d8b843be1d0b3633a3705b4b99e003a65cbce3d5d27cc896bd7906b9c22ff5
Instruction ID: d7a25bf90050b49ba98a2631a1ed91ab28a9a207d64f2fb76d908971fa696d09
Opcode Fuzzy Hash: 17d8b843be1d0b3633a3705b4b99e003a65cbce3d5d27cc896bd7906b9c22ff5
Instruction Fuzzy Hash: A8F06936200210AFC224DF59DC48F97B7F8EF89711F00881DF68997290DA74B809CBA1

Function 04E4CA40 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

TlsFree.KERNELBASE(?), ref: 04E4CA69

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 3aba30ef155284d3e9bf1d73e783b56114aa95cc551db6d9b5883235f2acc0fa
Instruction ID: 98833d13b2d3bff60d259ffc727b174de8638113494b50acc513fb5a3dd020e1
Opcode Fuzzy Hash: 3aba30ef155284d3e9bf1d73e783b56114aa95cc551db6d9b5883235f2acc0fa
Instruction Fuzzy Hash: DAE0DFB050531053E221DF28A808657BBD4AB4171CB29AE1DF0EB972C5C330F800C382

Function 04E65810 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,04DC49A6,?,?,00000004), ref: 04E6582C

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 751f615d4ac3fe7590913f298f543741074421c4f534851ee78fb5a2a067c5ef
Instruction ID: 159c6b06458c7571245d36f19c7452a52bcc08ad23318abf5260babdef61a1f9
Opcode Fuzzy Hash: 751f615d4ac3fe7590913f298f543741074421c4f534851ee78fb5a2a067c5ef
Instruction Fuzzy Hash: E8E0E2B2204711AF8364CF58E840D57B7F9EB88B10B00C91EB19DC3204D670EC458BA1

Function 04E65840 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,00000000,?,04DC49B9), ref: 04E65856

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d28887f326e2e77d1b00058349b0db1823ae0c85fced79f58593720f98d7893
Instruction ID: a9cd7417bc77f849e36d67f3c2a9c28c573d0833ac668086bb24077296006c61
Opcode Fuzzy Hash: 5d28887f326e2e77d1b00058349b0db1823ae0c85fced79f58593720f98d7893
Instruction Fuzzy Hash: 47D0C9B0110104EFD358CB24DC44E6673ADEB8831AF24859DE04E8B282C737EC47CB60

Function 04E30B00 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,?,04DFB244,00000001), ref: 04E30B08

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 98bb6cb0cbe1e50a63c7051ff444c2283971982efbbe92b78551df288405e0ac
Instruction ID: 073953566026487f6675ae1e65d00f1800bdd8e28732a1862a1c8b7f3d39c1be
Opcode Fuzzy Hash: 98bb6cb0cbe1e50a63c7051ff444c2283971982efbbe92b78551df288405e0ac
Instruction Fuzzy Hash: 26C09B772052305FC360DF5D9804D47FBD4DB58661701492BB588C3204C534CC40C790

Function 04E35FC0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,04E7A507,?), ref: 04E35FC5

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e51080f525d7d355334f5ab9a89eacfd2090ee0f45772329ee864bdd8d32cfc
Instruction ID: bacf291d5b71498e2d0fde7e734f4c297745c6306517dea2d7f57a483b51de33
Opcode Fuzzy Hash: 2e51080f525d7d355334f5ab9a89eacfd2090ee0f45772329ee864bdd8d32cfc
Instruction Fuzzy Hash: EEB012BB3101105BCB0847799D8994E32949F49A327200B1DB033C30C0DB34CC50AB11

Function 04E30B20 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,04DFC255,?), ref: 04E30B23

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f7257389726af57d77bb0da44f7f19e24067499b56eb46c61e3aff6854f27821
Instruction ID: aa4a2e53d1a666e53cfb845465cc12910e11728b89828a950d071c2c3c151544
Opcode Fuzzy Hash: f7257389726af57d77bb0da44f7f19e24067499b56eb46c61e3aff6854f27821
Instruction Fuzzy Hash: 9EA002719002109BCE00DBB6D94CD057768EB453067100596B411C6054CA399C40CA10

Function 02655C80 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

,gq, xrefs: 02655D3B

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: ,gq
API String ID: 0-3993090981
Opcode ID: 1c97e9e7fbd4dfc11f658b8a76533e0bbe970a11712466081822b0a5a7cfd1a7
Instruction ID: 3b78f48467197e97152789d291331c4a2b74e208d3132c7e018f6c3f09689020
Opcode Fuzzy Hash: 1c97e9e7fbd4dfc11f658b8a76533e0bbe970a11712466081822b0a5a7cfd1a7
Instruction Fuzzy Hash: FD818F717152658FCB199B78845C67A77E2AF85215FE540AACC07CB3A1EF30C842CB96

Function 099E1EF8 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

c, xrefs: 099E1F96

Memory Dump Source

Source File: 00000009.00000002.2778595133.00000000099E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: true

Associated: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_99c0000_LisectAVT_2403002B_286_Update.jbxd

Yara matches

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 46cf3e101da8102c6bf88aa8e6e2faeb891e765461b09d99b27b68e28d34f7f0
Instruction ID: 066d86f41ba3a7040c274cc95a023afc8de2a262b88671e21eab7ff5e8370d02
Opcode Fuzzy Hash: 46cf3e101da8102c6bf88aa8e6e2faeb891e765461b09d99b27b68e28d34f7f0
Instruction Fuzzy Hash: BE51F676F042298FCB15EB68D8400AEFBA3FFC5360725856AC859AB341DB309D06CBD1

Function 02651FDC Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

Tcdq, xrefs: 02652035

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: Tcdq
API String ID: 0-153738649
Opcode ID: c5fa3a5985d4619f93f65a64f0a7a6178e39ec69dc7df118573ff7176251335b
Instruction ID: 4da6ef5286daf52761791c0d3c29f17a69af158f2443dc91af31ba14d29d1972
Opcode Fuzzy Hash: c5fa3a5985d4619f93f65a64f0a7a6178e39ec69dc7df118573ff7176251335b
Instruction Fuzzy Hash: 5521FEB1C01258AEDB20CF99C594BDEBFB5AF48314F24806AE819AB240C3751885CF91

Function 0265BF25 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

,B2, xrefs: 0265BFC9

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: ,B2
API String ID: 0-739408609
Opcode ID: 4c22a9082e6ae1b2a831644ed31d1247b3d080f8da24e8222f725a39f0787d31
Instruction ID: 22f91de3d62e7a1c6ad015d0b2e08b21c73a899434aae35ac4f7541d66816258
Opcode Fuzzy Hash: 4c22a9082e6ae1b2a831644ed31d1247b3d080f8da24e8222f725a39f0787d31
Instruction Fuzzy Hash: A0113831E05284AFCB059FB8C8196ADBF72EF82340F2080EAD509E7191DE349A05DB91

Function 02651FE8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

Tcdq, xrefs: 02652035

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: Tcdq
API String ID: 0-153738649
Opcode ID: 12da6e6f809c47778fba5bccd3c9eb120159eebc41395396720cef22150a1e7b
Instruction ID: be55cb4fdc5995885bf4bcaad64b563e172b2a7e79fa6448c81b57b6caa01b5a
Opcode Fuzzy Hash: 12da6e6f809c47778fba5bccd3c9eb120159eebc41395396720cef22150a1e7b
Instruction Fuzzy Hash: 1621BEB1D012589FDB20DF9AC994BDEBFF5AF48314F248029E819BB280C7755885CFA5

Function 04E66E10 Relevance: 1.3, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

Part of subcall function 04E30AC0: GetLastError.KERNEL32(00000000,04E66E59,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AC3

CloseHandle.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E66E71

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$CloseHandle
String ID:
API String ID: 3463825546-0
Opcode ID: c911036e626ad661a172e240fe455293b5667eb1d17deabee7c05a3bccd016d3
Instruction ID: 0fe1d14a10c55c3eb769fd177f103417522ed66919137b5930fc104f849b6e6d
Opcode Fuzzy Hash: c911036e626ad661a172e240fe455293b5667eb1d17deabee7c05a3bccd016d3
Instruction Fuzzy Hash: 020140722446105BC214DA78C880E5BB3E5AFC8A68F20CB1DF5AA972E4D730EE02C791

Function 0265BF78 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

,B2, xrefs: 0265BFC9

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID: ,B2
API String ID: 0-739408609
Opcode ID: 9834a68f90c0c8d17e254b35ecbfbefeeab464674771e990d73782b282dc3f67
Instruction ID: 97a838af378bff43d623ed1b1f63143d086b338b506b81bc2b319886cbd3a404
Opcode Fuzzy Hash: 9834a68f90c0c8d17e254b35ecbfbefeeab464674771e990d73782b282dc3f67
Instruction Fuzzy Hash: FDF0F635F00218ABDB08ABF99C09B9EB772EF82340F508075EA0DE3284EE3095008F95

Function 04DC4830 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 04DC4846

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c354873c5727ccc2b8ef44bb2caa2bef5b4b8bc9104eb43f1cc48c9e35521a75
Instruction ID: 5b4f5bab8e1e6683c34e040027efc18847eaec94093363d8df2247795ea74cf2
Opcode Fuzzy Hash: c354873c5727ccc2b8ef44bb2caa2bef5b4b8bc9104eb43f1cc48c9e35521a75
Instruction Fuzzy Hash: 1AE048705042525AFF218F299815F57B7D46F01368F14892DE4B8C31D1D774F845C752

Function 04E97E30 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000005,00001000,?,04E65A9B,?,00000005,00000040,?,?,?,?,00000000), ref: 04E97E41

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b2ee6b103903e08cafdbc525fb68ad67ee7df34c17d1a3f55d5b3bc1dee7585f
Instruction ID: ec59a5197df960fb9a1f02638f8f0801fe725c4364b1f34eefda5c77366c6efe
Opcode Fuzzy Hash: b2ee6b103903e08cafdbc525fb68ad67ee7df34c17d1a3f55d5b3bc1dee7585f
Instruction Fuzzy Hash: E1C09B752443007FED04C751CD45F667774E784752F104509B545461D4C5B06C40C611

Function 0265BC62 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958f957f68619244eedbcb273f9ae289d71fc140ce9cd1fa6e996b44db5caa3c
Instruction ID: a04193778524610f2e3602dafb2d3151c72947ed127c91cac4114ee31f617b2e
Opcode Fuzzy Hash: 958f957f68619244eedbcb273f9ae289d71fc140ce9cd1fa6e996b44db5caa3c
Instruction Fuzzy Hash: 4A515A72D093A58FC707DB38C8941ADBFB1EF56258F1902E7C844DB2A7DA244C06CBA5

Function 02655210 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb280df31396d69f982075ff0aa715b3c3026e982d9aca071070d6629b7a9d7f
Instruction ID: fc198bd21147df949a99545c717fe84a3205ac9468b1cdb05adf1048f4a46d6a
Opcode Fuzzy Hash: fb280df31396d69f982075ff0aa715b3c3026e982d9aca071070d6629b7a9d7f
Instruction Fuzzy Hash: E9613870A08259DFCB05DF78C89446EBBB2FF81310B6449EAD84ADB392DB359D45CB90

Function 026512AF Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3741b0bcba23b722fdd60778307b08713ddc9fde2dbb82ec25a2d054c43fae5e
Instruction ID: 80a3234a23919d62c57f73277759156751a779c9a4228a3c94f57427783d6ede
Opcode Fuzzy Hash: 3741b0bcba23b722fdd60778307b08713ddc9fde2dbb82ec25a2d054c43fae5e
Instruction Fuzzy Hash: F4418B31B002118BCB55AB39D52866F3AE7EFC8710B10896DD80ADB3A5EF75DC068BD1

Function 026512B0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21eaa4f8a56a1b41976b7871ba9cda936a8ccf8345a7d8a853b374ed2d1c2ab6
Instruction ID: 8dbbba3a0fdf943e7ccfed1915fa1f6934a8d288abeb3be5af6ae9806fe600ea
Opcode Fuzzy Hash: 21eaa4f8a56a1b41976b7871ba9cda936a8ccf8345a7d8a853b374ed2d1c2ab6
Instruction Fuzzy Hash: BF418B31B002118BCB15AB39D52862F3AE7EFC8710B50896DD80ACB3A5EF75DC068BD5

Function 02651C00 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5b85707fa145490e7c888032ca18d2015de3987670e0e1e293801ad68ab22f
Instruction ID: a4cdc62533964e413c37458c5a9869dae76e34e5bfa0cb914ea80903b0817d05
Opcode Fuzzy Hash: 9a5b85707fa145490e7c888032ca18d2015de3987670e0e1e293801ad68ab22f
Instruction Fuzzy Hash: 39216130A01215CBDB29ABB5C51437E76A6AF85305F5008AECC56E7380EF7ADC01DBA5

Function 02651BFF Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2658eaa98f431bb218107f6a8d784f71553ca0b000e277f5834953bc9ca260
Instruction ID: 5f28afc2b0f0939ac45519d29dd223ec53a3488242dbc86444374ca1d4b93349
Opcode Fuzzy Hash: 8b2658eaa98f431bb218107f6a8d784f71553ca0b000e277f5834953bc9ca260
Instruction Fuzzy Hash: B7219231A00215CBDB25ABB5C5143BE7AE6AF85304F1008ADCC56E7380EF76CC06DBA5

Function 0265BDC7 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2c53e931cbce2eae9b9eddd0f3b24d38ed5aada78d82ef70e8c95045900b40
Instruction ID: 2f7ff89636abef6c92b70b5781ff80bbbcc31fbcc3cd25cad175c87fe0996a33
Opcode Fuzzy Hash: cb2c53e931cbce2eae9b9eddd0f3b24d38ed5aada78d82ef70e8c95045900b40
Instruction Fuzzy Hash: 3A119032F001298FCB54AF6998855AEFBE3EBC9264B59417AD809E7354DB708C068BD0

Function 0258D01C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2758793057.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_258d000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618f04776003afa93a44e56d658e83a18dc932eba5478e01db9bc5e76299b71f
Instruction ID: 28a8f87744921dd315218b4003d0d870f300b36251bf04bd64d986dc2fa22b81
Opcode Fuzzy Hash: 618f04776003afa93a44e56d658e83a18dc932eba5478e01db9bc5e76299b71f
Instruction Fuzzy Hash: F5212F71605200DFDB14EF24C984B36BBB5FB84318F20C96DE8096B282D37AD807C666

Function 0265B59A Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4893c87fb9f03f4f20d1b5b81194d0156fa6c8184432afb04762f3d38ee941e
Instruction ID: 914bf54ddc000761ee793e4dcb47127db61e8f924e9b2d250d3f176bd6a709af
Opcode Fuzzy Hash: b4893c87fb9f03f4f20d1b5b81194d0156fa6c8184432afb04762f3d38ee941e
Instruction Fuzzy Hash: 0E11D077F101348FDB049E788841759B7E3ABC8694F5A82A9EC01EF395EB71DD018B80

Function 02655B31 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f586d5366572c7999ba72f2e349e0de3992aaaf1c99de411769ea0fb8489fe48
Instruction ID: a8cea969efe1d5905e532c55aecdfaa5deb6fcc2ac00e7496a3a54b428566b5d
Opcode Fuzzy Hash: f586d5366572c7999ba72f2e349e0de3992aaaf1c99de411769ea0fb8489fe48
Instruction Fuzzy Hash: D7117870300B114FC7169F38C468A9ABFB6FFC1320B058A2DD8428B741CB719C05C790

Function 0265BDE0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e89ade147848f7138bca7e9e8e3f6e26db8158367403b21140b6e9a4915958
Instruction ID: 455762fe07879deef6095600b39fd810358194d10f46a1e18d5f4e9dd1727022
Opcode Fuzzy Hash: f8e89ade147848f7138bca7e9e8e3f6e26db8158367403b21140b6e9a4915958
Instruction Fuzzy Hash: A611C831F105298B8B14EF6D984556EF7E7EBC9264B584179D809E7354DB708C0687D0

Function 0265BDDF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d606b43cf0a2342d421ffd7e9e64899ddff204e1a8cf0ff54f218b85115458f9
Instruction ID: 93fdbf02f1d0e4349d336cd9d53ba003a25a0ec0c66c58cad48fd139e5487f98
Opcode Fuzzy Hash: d606b43cf0a2342d421ffd7e9e64899ddff204e1a8cf0ff54f218b85115458f9
Instruction Fuzzy Hash: 1C119432F005298F8B14DF6D98855BEFBE3EBC9264B194179D809E7354DB708C068BD0

Function 0258D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2758793057.000000000258D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0258D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_258d000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1dc4007b9823599caf6f575a148eedd3790bfb4e13e7fc03d38be7a801c7bbe
Instruction ID: fa01dfaa416c6bfa2144a3c5c921cf62ba06394764ce1ea3969100a9305a1ca0
Opcode Fuzzy Hash: a1dc4007b9823599caf6f575a148eedd3790bfb4e13e7fc03d38be7a801c7bbe
Instruction Fuzzy Hash: 9221A17550A3C0CFD702DF20C594725BFB1FB46214F28C5DAC8898B693C33A984ACB62

Function 02655058 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c00438dd49f838ad3499a5793bbc91cd328ea4fafed6d02c2f9d929db0360c9
Instruction ID: 9b742766d409e43b3c65455f9c45d43479943c472ae42b2d026b4448efa379cb
Opcode Fuzzy Hash: 8c00438dd49f838ad3499a5793bbc91cd328ea4fafed6d02c2f9d929db0360c9
Instruction Fuzzy Hash: 040149307082908FC702AB6AD85856EBFF2FFC522075405AED44E87292CE244D46C7A1

Function 026520E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760153857e8e2353f795bd33433fc1fced503c752d59007b0019f93023ded668
Instruction ID: b991b314c7a8a455df66e173d3b396776c66de45394f0c5883412bc5eec67ebf
Opcode Fuzzy Hash: 760153857e8e2353f795bd33433fc1fced503c752d59007b0019f93023ded668
Instruction Fuzzy Hash: 9901AD327002A687DB3A67BA813027F7A939FC0354F14056D8E428B395EF25DC028796

Function 02655B50 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f0059a4e7bb650f6fa14025c103b5e77374ee3d3809922cd630d3aa63ad2ae
Instruction ID: 0823e41a8f4fc59571f9b9a87ee4b24bf56fdf2da754cb8b3409b565629a7163
Opcode Fuzzy Hash: d6f0059a4e7bb650f6fa14025c103b5e77374ee3d3809922cd630d3aa63ad2ae
Instruction Fuzzy Hash: EE11E571300B124BC3119B6CD4A8A9A7BB6FFC5320B558A2CD9468B741DB7598068794

Function 026520E8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8edcc8e603538a1caac919c516d71b42467dfc513e4621cc048c77166efa1639
Instruction ID: eb65c7d182d826a7e3320bcd481ce8d3caca79e2e5d51e264feaaa7187c671f4
Opcode Fuzzy Hash: 8edcc8e603538a1caac919c516d71b42467dfc513e4621cc048c77166efa1639
Instruction Fuzzy Hash: BF019E3270026647DB7A66BA853033F78879FC0744F04456D8E478B794EF20DC0286A6

Function 02655490 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852115d8a11710e667a1542229148ea6c9724066974559221be1dd0621b10922
Instruction ID: 4c92eeca01972d6806ace2049e80cc808aaabe6ef44cdcae2c8f7e2682af5413
Opcode Fuzzy Hash: 852115d8a11710e667a1542229148ea6c9724066974559221be1dd0621b10922
Instruction Fuzzy Hash: 09119B70A4D2C89FC746DBB8C4554AD7FB1BF8621076404EEC086DF263CA255D46DB51

Function 026554A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de18cbf9d3ac73406d0f4d6e86c13a5e8ace774bd5206c5fccdd56ac1d4ef428
Instruction ID: 68ab12b42bd2acad174935588663fa9f646507109acc1dc228eb5bce1409e0d6
Opcode Fuzzy Hash: de18cbf9d3ac73406d0f4d6e86c13a5e8ace774bd5206c5fccdd56ac1d4ef428
Instruction Fuzzy Hash: DA01B970A4C2C89FC746DBB8C8654ADBFB1BF8621076404EAC086DF2A3CA255D45DB61

Function 02651D2E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d81348dcd5d4c1902523c8ab0ce94543f76c3a3c1891ed0291cc7183ca96a13
Instruction ID: 9ac1c6cea2f8141313a724715def0c73473e88bfe3272e6cf475992d9b54d49b
Opcode Fuzzy Hash: 8d81348dcd5d4c1902523c8ab0ce94543f76c3a3c1891ed0291cc7183ca96a13
Instruction Fuzzy Hash: BE118B31A01315CBEB14ABF1851836D76BAAF4A304F1008AECC43E6290FF7AC915DA65

Function 02651D25 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75174ce6abd3365a79fb528a648b03bc588995926f62ec18633031230c5fa9cf
Instruction ID: 09f110b509f1bfc616568c02d23038016eb65b373389e7d0f5a5a8110bab0d99
Opcode Fuzzy Hash: 75174ce6abd3365a79fb528a648b03bc588995926f62ec18633031230c5fa9cf
Instruction Fuzzy Hash: 68018431A01315C7EB14ABF1C51836D76B6AF09304F1008AECC47E62D0EF7AC915DB65

Function 02655B60 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a7ed829f9beea6f56e46a5c72786b8e9cd5c94fecd7c8ea26cff1cf752eaae
Instruction ID: ca50211279fc60b956e3a6170871999cb3bb3544b494799635a0e2d376224adc
Opcode Fuzzy Hash: 78a7ed829f9beea6f56e46a5c72786b8e9cd5c94fecd7c8ea26cff1cf752eaae
Instruction Fuzzy Hash: 1501D4B1300B228BC310AB69D458A5ABBA6FFC4320B544A2CE9078B340DFB5EC458795

Function 02650BD0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b45c998bad51b6d404a42654876964c62fd42ea650136ed432d5d91284ca804
Instruction ID: 756ef2969fb1e1ab1b8baacb81d010db07d3dbcdb3f01ef3c2fb918b8e9a37a1
Opcode Fuzzy Hash: 5b45c998bad51b6d404a42654876964c62fd42ea650136ed432d5d91284ca804
Instruction Fuzzy Hash: 8E118E7084D3C59FC70ADF78D8A14897FF4AE4222071980EBC049DB2A3DB24490EDF16

Function 02651E71 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e354a0cc7a855a76e2ddb0ace29f9c2fc76e8c953a41e9be9b6c87b9634feefd
Instruction ID: 822de2418c92f7e5c7fc7f3d51cf3f4611725fe6c63650fdf1fb986df203e55b
Opcode Fuzzy Hash: e354a0cc7a855a76e2ddb0ace29f9c2fc76e8c953a41e9be9b6c87b9634feefd
Instruction Fuzzy Hash: EB1155B58002598FDB10CF9AC944BDEBBF8EF48320F14855AD468A3290C778A544CFA0

Function 02651E78 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf86606adcb8d8f7e6a2fd656a37fcbc4579cc12e6942f188f67dcdcf74a012a
Instruction ID: f73c03a3ae054d97df56599eeb76c0c634250c6841a168ab5c337ec8ba68a2a4
Opcode Fuzzy Hash: cf86606adcb8d8f7e6a2fd656a37fcbc4579cc12e6942f188f67dcdcf74a012a
Instruction Fuzzy Hash: CD1136B1800259CFDB10CF9AC944BDEFBF8EF48320F14845AD518A3240D778A944CFA5

Function 0257D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2758512570.000000000257D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_257d000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24222a248aa32b285314aa1fbefde6b3085276173566708c221168256a969bc6
Instruction ID: b07d86dc439a4e08c239fd9d8cb2b450728b210f1081ec7cd8d9c1235c7d4ed5
Opcode Fuzzy Hash: 24222a248aa32b285314aa1fbefde6b3085276173566708c221168256a969bc6
Instruction Fuzzy Hash: 8001406200E3C05FD7128B259994B66BFB4EF53224F1D80CBD8888F1A7C3695845C772

Function 0257D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2758512570.000000000257D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0257D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_257d000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698d6c5f3e3517edf45c38464bab0db3e71b1f284a8445fb181a1cf29b028ea5
Instruction ID: 89cc0dac6ec3bc3e200877be0321d0f83fd9df4d0254808221efa2d8064fa6f1
Opcode Fuzzy Hash: 698d6c5f3e3517edf45c38464bab0db3e71b1f284a8445fb181a1cf29b028ea5
Instruction Fuzzy Hash: 8401F7710463409EE7118E25D9C4776BFA8EF41334F18C819EC480B142D3799841C6B5

Function 02650862 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4d4e0835dd236294ea94eb15830e4858505ffc54a1561e818d0f87ddd38958
Instruction ID: c0338ad23ff71b81d49b09515a691a84579e6d41f04cc96f2ff8fb32d38d2639
Opcode Fuzzy Hash: dc4d4e0835dd236294ea94eb15830e4858505ffc54a1561e818d0f87ddd38958
Instruction Fuzzy Hash: CE014730949198DEDB01AFB4B8450F93B66FB44328FA004DAC94167102DB65452EEBA6

Function 026554D8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531aefc43d33461c74f53ec5f7aa2db784083e29ef59e12caaaf2a25bf17e1bf
Instruction ID: e7252f8c4a8c9436391f3cb55312a2aab9d56e8e2aaaf760c8209f0217bcdc36
Opcode Fuzzy Hash: 531aefc43d33461c74f53ec5f7aa2db784083e29ef59e12caaaf2a25bf17e1bf
Instruction Fuzzy Hash: A2F0E93094C2C48FC706DBB4C4584997FB0FE0622432404DED48ACF273C6288D46DF51

Function 02655A88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3508c281bb64472fa8addec4435068d09fbc0f1cd926f406622fc4b855c8e1f
Instruction ID: 38ae54f4349715e2eb2550d04e8eb45d7f52fe226981d2385685806b91efc9dc
Opcode Fuzzy Hash: a3508c281bb64472fa8addec4435068d09fbc0f1cd926f406622fc4b855c8e1f
Instruction Fuzzy Hash: BEF0A47056420ADBC701EB74F844A9E7B77FFC0300F5086A8D50A87749DE704D45BB92

Function 02655A98 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f57a1932ade4e2163448d9d3bb1f9349a63931ba96c1c3d4679f8f5dbff95a
Instruction ID: b1337337b0c23149c559d263822b9a5798d42c1d8cc7ed904f5cda54c5ba1d28
Opcode Fuzzy Hash: 79f57a1932ade4e2163448d9d3bb1f9349a63931ba96c1c3d4679f8f5dbff95a
Instruction Fuzzy Hash: EFF0627156460AEBC701FB74F804A9E7B6BFFC0300F5085A8D50A87749DF705D45AB96

Function 02650B70 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e287d909e172e19229b0f6fddcac74524bd8e66efb71a19e5e34f4d8aec9f7
Instruction ID: e4f782b8554f438eff4b9861c20e8300d9a6d326a9afa0e320bc472871d8a256
Opcode Fuzzy Hash: d4e287d909e172e19229b0f6fddcac74524bd8e66efb71a19e5e34f4d8aec9f7
Instruction Fuzzy Hash: 00F0B4B0945206AFC701DF78F9106AD7BB5EF86200B5049AAC004E7251EE710D15DF14

Function 02650950 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca43f76fa8da653c2ec72fcb14c8649414f414996a890ed50d7d9e812cd36344
Instruction ID: 34cb458df1288521be98c0a9e627676bf7f40c8d3cca5981d42566bf13f8ca46
Opcode Fuzzy Hash: ca43f76fa8da653c2ec72fcb14c8649414f414996a890ed50d7d9e812cd36344
Instruction Fuzzy Hash: 4FF02760848094ADCB109B746C051FABFEDBF05220F1405DAD88CA7103D761412ACB62

Function 0265BEA8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae81bb2a9e77112ea6e77685607d7400acb3fe8912d2e1e3b86fd24bccebd298
Instruction ID: 5f779781d81bea10ebc0082f7bf10a56733204d23f941fff21b133049d3573e9
Opcode Fuzzy Hash: ae81bb2a9e77112ea6e77685607d7400acb3fe8912d2e1e3b86fd24bccebd298
Instruction Fuzzy Hash: F2F0A76594D2C49FCB869774A8610ADBF72AB8320175804DAC08ADB2A6CA644D06E751

Function 02651F60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a782d4181845bbff37b820a96e9088982e57dadedd3fb4aaa1069c30cc5d62db
Instruction ID: 13314959a17af53e285aeb1e2c861050faf9aa7dba0372fc64b0fdd778912f8d
Opcode Fuzzy Hash: a782d4181845bbff37b820a96e9088982e57dadedd3fb4aaa1069c30cc5d62db
Instruction Fuzzy Hash: DFF02470D40219CFCB01AFB844052FD7BF4EB05304F104469C815AA200E7B604168F84

Function 02651F68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11faa8b5605cd52c068899fa973c31686143e2a64e1eae504f88a9bc20ae3858
Instruction ID: 0d0e1b8779c01bde8ed08df5ee3c7bc773cb20b630d99eee0d1b10ebe8ecc0bf
Opcode Fuzzy Hash: 11faa8b5605cd52c068899fa973c31686143e2a64e1eae504f88a9bc20ae3858
Instruction Fuzzy Hash: 27F02770E40329CFCB00AFB988043BD7AF8EB06308F504465D918AB340EBB545168FC5

Function 026550AF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0397fbb9db99a1da6b36089febd04acbd314d55be7d563eebcb8028c374e5a7
Instruction ID: fef0dac225e9d13c65adbfa654bd41a024c9c2b8a40c30edac90bb9b53c2dbcc
Opcode Fuzzy Hash: f0397fbb9db99a1da6b36089febd04acbd314d55be7d563eebcb8028c374e5a7
Instruction Fuzzy Hash: 39E0DF31B046209B8715A6AFF8448AFBBEAFFC9221354493EE40EC3352CE615C068A61

Function 026550B0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97128e1472d824b48415badae2bf5566d9f52e1121c3707b62c139866914655
Instruction ID: f98edfc33ba0d81573b50f4b44f4c1ceb140b0f486e2205016288f3c6fbc999f
Opcode Fuzzy Hash: f97128e1472d824b48415badae2bf5566d9f52e1121c3707b62c139866914655
Instruction Fuzzy Hash: 67E02631700620978214B69FF84445FBBEFFFC9221384483EE40EC3352CE216C0646A5

Function 02655C00 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60666ad3c76fa23384c0e27fbff1bd400214bee20918a7487e4343cda4a6b3e
Instruction ID: 143d34e21b299f407c5111299793fefab0f287cca00e1c591f631379eb38c503
Opcode Fuzzy Hash: b60666ad3c76fa23384c0e27fbff1bd400214bee20918a7487e4343cda4a6b3e
Instruction Fuzzy Hash: FDE09270A09284AFC742CBB898616EE7FF5CF87204F1044E9D8C4DB242D9320A06D752

Function 0265BEB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d19bceee7490d9e9df0046438dbe6cfb038b4038ff77ec9ba9937f0caef5072
Instruction ID: 09da7cdf4f9f626936d5b58208ca65c5e4de30f6896deee158677fdf53d725fc
Opcode Fuzzy Hash: 8d19bceee7490d9e9df0046438dbe6cfb038b4038ff77ec9ba9937f0caef5072
Instruction Fuzzy Hash: 10E0D13054D288DFCB45D775D41145DBFB6AFC324072040D9C04EDB292CD304D05D715

Function 02650B80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11605f31c46ce3f708cec154ed70bc19176afb510468af8ea98c34bb37e73de
Instruction ID: 233f94b122ebcc81868e251cd7ecca8db1652a0cd1a0be171998534b6ea76371
Opcode Fuzzy Hash: c11605f31c46ce3f708cec154ed70bc19176afb510468af8ea98c34bb37e73de
Instruction Fuzzy Hash: 9FE06DB090520ADFCB00EFB8F90065DBBB9EB45201F9099A8D408F7354EE715E14EF54

Function 02650999 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e51c243ae6583d02e68b74f343ff2e304b25bfd24f9c0cf803479659a701c73
Instruction ID: ece32e503fff29d608f488a2fe0239d5fd2fcdcfc4c50a220c106c736c828bff
Opcode Fuzzy Hash: 3e51c243ae6583d02e68b74f343ff2e304b25bfd24f9c0cf803479659a701c73
Instruction Fuzzy Hash: 44E0C220D480A8C7D30DBF54E81D279779BFBC4324F2014AE845E2B24ACA508829EF1B

Function 02650C28 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c37e79c425a0bfc3e8a501ccb8b17c1b8b08f735f8b000603a96620e4dab8a
Instruction ID: 49e4226fe79c4c528eb7420f5cb906b7c2540f3a0804eb24b3ddd289808b4d30
Opcode Fuzzy Hash: c3c37e79c425a0bfc3e8a501ccb8b17c1b8b08f735f8b000603a96620e4dab8a
Instruction Fuzzy Hash: 7FE012B0C442099BCB0CEF69E84109DBBF8EB45310F5085BEC40DA3264EB705669AF89

Function 02655C10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f8d6251360bf0747db2e428ed2811523c3b86e4227415441853d284f7a713a
Instruction ID: 266e784043ac08e5c4de9296cea174d8ee4d349ec35292e66b59a2fb96a8030d
Opcode Fuzzy Hash: 87f8d6251360bf0747db2e428ed2811523c3b86e4227415441853d284f7a713a
Instruction Fuzzy Hash: D4D01770B01208ABCB40DFB8D50465EBBEADB85304F1084A9D809D7340EE326E049B91

Function 02650930 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4e9ba0609dddc9402e59611768d0df44b40ff76b563d4aa81ecb10537c41bc
Instruction ID: 8f0a66a8b9f9b8d18ef34651db715198af58426a07a2fbab48de651e3987659b
Opcode Fuzzy Hash: ec4e9ba0609dddc9402e59611768d0df44b40ff76b563d4aa81ecb10537c41bc
Instruction Fuzzy Hash: 19C0126008E3C13EC787163468908923FB80C9321030904EBE488A9473C0260029E326

Function 02650C68 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d05f90757ac09d9a308835197251a0fd59e6fb0d45387563c8455939087924
Instruction ID: 981514a0fc2f8cefc3b4e918575df12a7658ae366a39efc250f0ef90c9eec40b
Opcode Fuzzy Hash: 07d05f90757ac09d9a308835197251a0fd59e6fb0d45387563c8455939087924
Instruction Fuzzy Hash: 7ED0CA30880244CEC708AF40A88ABA0BBF8EB01326F01A485C00C1A552C3F040A8EF9D

Function 02655530 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba1a2919e527f6cb332e92f87853fbdfecc367bd4cd8a6a2ae4ff2f82d6e65c
Instruction ID: a12ea09a2ef06a0298718637974fe9561b57a333b5c00572f3cb35e9867e8315
Opcode Fuzzy Hash: cba1a2919e527f6cb332e92f87853fbdfecc367bd4cd8a6a2ae4ff2f82d6e65c
Instruction Fuzzy Hash: A0C092B5540208CFC304DF58D844C20B3B8FF0962530100D1EA098B333C721EC82CE90

Function 02650C70 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcdbbab4c174eaa4bedd9efa96bdf7e084c89c4cba6199eb2e2220440b46c17b
Instruction ID: 386ce9e402b661c21328a7a2fc8c339cfbc5b5b8435fd14801db080fa273bd2d
Opcode Fuzzy Hash: fcdbbab4c174eaa4bedd9efa96bdf7e084c89c4cba6199eb2e2220440b46c17b
Instruction Fuzzy Hash: DBC04830880608CADB046E80A80A3A037ECE70432AF402914D50C26A41C7F550ACAE9E

Function 02650850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc616ea7e06e022128b67cc196428ab0ae758b46991d931eb1c591253a57903
Instruction ID: 76de9f31dd9748d6d4459f3e4acfa2091b5bdca825fb6b676341311957d68bc7
Opcode Fuzzy Hash: 8cc616ea7e06e022128b67cc196428ab0ae758b46991d931eb1c591253a57903
Instruction Fuzzy Hash: E790223008020CCB02002BC0380C0A0330C82000223800000E80C200000A802028208C

Function 02650940 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43007321cf97a43a05f4ecdbe82db582ff6c1b25b7ccde9cd23d34188c357e2
Instruction ID: d913b23f11d1321a5be00fd2f711add5d082d1df6577639044a660258135f66f
Opcode Fuzzy Hash: c43007321cf97a43a05f4ecdbe82db582ff6c1b25b7ccde9cd23d34188c357e2
Instruction Fuzzy Hash: CD90223008020C8F03802B823808280B32CA0002003800802A00C000022AA220200088

Function 0265BF00 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2759653882.0000000002650000.00000040.00000800.00020000.00000000.sdmp, Offset: 02650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2650000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df805a6b873b57bafb100874019cf85e17c5edb29c6e1d912926a950b108ff3
Instruction ID: a15491b8fb5c82e19f64a2f3643ad1f5d7f2b9ead9c1577205dcbd155e79eb60
Opcode Fuzzy Hash: 1df805a6b873b57bafb100874019cf85e17c5edb29c6e1d912926a950b108ff3
Instruction Fuzzy Hash: BA90023104460CCB45802796740956AB75CD7465567904056A50D815035AA5643146AA

Non-executed Functions

Function 04E764A0 Relevance: 174.6, APIs: 90, Strings: 9, Instructions: 1359filememorynativeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 04E764F1
ReadFile.KERNEL32(00000000,?,00000040,?,00000000), ref: 04E76514
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 04E76523
ReadFile.KERNEL32(00000000,?,000000F8,?,00000000), ref: 04E76541
CloseHandle.KERNEL32(00000000), ref: 04E76544
NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 04E76592
ReadProcessMemory.KERNEL32(?,?,?,000001D8,?), ref: 04E765B3
ReadProcessMemory.KERNEL32(?,?,?,00000040,?), ref: 04E765CD
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 04E765F3

Part of subcall function 04E6D7B0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,75934470), ref: 04E6D820
Part of subcall function 04E6D7B0: GetLastError.KERNEL32 ref: 04E6D839
Part of subcall function 04E6D7B0: CloseHandle.KERNEL32(00000000), ref: 04E6D8C4

VirtualProtectEx.KERNEL32(?,?,000000F8,00000004,?,?,?,?,?), ref: 04E7667E
WriteProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 04E766A7
VirtualProtectEx.KERNEL32(?,?,000000F8,?,?), ref: 04E766CE
VirtualAllocEx.KERNEL32(?,?,?,00002000,00000001), ref: 04E767B2
VirtualAllocEx.KERNEL32(?,?,?,00001000,00000040), ref: 04E767C6
MapViewOfFile.KERNEL32(000002D4,00000004,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 04E7681A
UnmapViewOfFile.KERNEL32(00000000), ref: 04E76839

Strings

BoxedApp::CBoxedAppCore::AttachToProcess_Native, xrefs: 04E76961, 04E769E7, 04E76A76, 04E76B25, 04E76BAC, 04E76C32, 04E76CC1
, WriteProcessMemory() for info.m_SplashScreenData.m_pImageData failed, GetLastError() = , xrefs: 04E76BA7
, DuplicateHandle(GetCurrentProcess()) failed, GetLastError() = , xrefs: 04E76C2D, 04E76CBC
BoxedAppSDK_RemoteAgent_ThreadProc, xrefs: 04E76847
, WriteProcessMemory() for info.m_szFileToDeleteAfterProcessExit failed, GetLastError() = , xrefs: 04E76A71
, VirtualAllocEx() for info.m_SplashScreenData.m_pImageData failed, GetLastError() = , xrefs: 04E76B20
, VirtualAllocEx() for info.m_szFileToDeleteAfterProcessExit failed, GetLastError() = , xrefs: 04E769E2
, DuplicateHandle(pCreateProcessAdditionalInfo->m_hProcessToWait) failed, GetLastError() = , xrefs: 04E7695C
core, xrefs: 04E76966, 04E769EC, 04E76A7B, 04E76B2A, 04E76BB1, 04E76C37, 04E76CC6

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: File$ProcessRead$MemoryVirtual$AllocCloseCreateHandleProtectView$ErrorInformationLastPointerQueryUnmapWrite
String ID: , DuplicateHandle(GetCurrentProcess()) failed, GetLastError() = $, DuplicateHandle(pCreateProcessAdditionalInfo->m_hProcessToWait) failed, GetLastError() = $, VirtualAllocEx() for info.m_SplashScreenData.m_pImageData failed, GetLastError() = $, VirtualAllocEx() for info.m_szFileToDeleteAfterProcessExit failed, GetLastError() = $, WriteProcessMemory() for info.m_SplashScreenData.m_pImageData failed, GetLastError() = $, WriteProcessMemory() for info.m_szFileToDeleteAfterProcessExit failed, GetLastError() = $BoxedApp::CBoxedAppCore::AttachToProcess_Native$BoxedAppSDK_RemoteAgent_ThreadProc$core
API String ID: 1411872835-4154453438
Opcode ID: 24412d577d3935869eba21a287f2c1c56316440b730eef1b679b0dea724a69d5
Instruction ID: b77a0e800d3df46e2d87c95843e28d9da5e21dfe1e2015becd85347702250801
Opcode Fuzzy Hash: 24412d577d3935869eba21a287f2c1c56316440b730eef1b679b0dea724a69d5
Instruction Fuzzy Hash: 40B26C71604341AFE724EF65DC84FABB7E9EFC4718F00491DE58997280EB74B9058BA2

Function 04E2E780 Relevance: 81.4, APIs: 33, Strings: 13, Instructions: 857memorycomCOMMON

Download Yara Rule

APIs

Part of subcall function 04E30220: CoInitialize.OLE32(00000000), ref: 04E30225

Part of subcall function 04E98F90: GetFullPathNameW.KERNEL32 ref: 04E98FD6

CoCreateInstance.OLE32(04EA867C,00000000,00000017,04EA868C,?,?,00000000), ref: 04E2E7C0
VariantClear.OLEAUT32(?), ref: 04E2E837
SysAllocString.OLEAUT32 ref: 04E2E84B
VariantClear.OLEAUT32(?), ref: 04E2E919
SysAllocString.OLEAUT32 ref: 04E2E927
VariantClear.OLEAUT32(?), ref: 04E2E949
VariantClear.OLEAUT32(?), ref: 04E2E9BF
SysAllocString.OLEAUT32 ref: 04E2E9CD
VariantClear.OLEAUT32(?), ref: 04E2E9F1

Part of subcall function 04E00BC0: SysAllocString.OLEAUT32(?), ref: 04E00C00

VariantClear.OLEAUT32(?), ref: 04E2EA98
VariantClear.OLEAUT32(?), ref: 04E2EA9F
VariantClear.OLEAUT32(?), ref: 04E2EB17
VariantClear.OLEAUT32(?), ref: 04E2EB1E
VariantClear.OLEAUT32(?), ref: 04E2EBA3
VariantClear.OLEAUT32(?), ref: 04E2EBAA
VariantClear.OLEAUT32(?), ref: 04E2EC0E
VariantClear.OLEAUT32(?), ref: 04E2EC15
VariantClear.OLEAUT32(?), ref: 04E2F387

Strings

culture, xrefs: 04E2ED1A, 04E2EDAA
SelectionNamespaces, xrefs: 04E2E9FC
processorArchitecture, xrefs: 04E2EFB0, 04E2EFFE
SelectionLanguage, xrefs: 04E2E966
name, xrefs: 04E2EC44, 04E2ECA3
none, xrefs: 04E2F20E
/microsoftNs:assembly/microsoftNs:assemblyIdentity, xrefs: 04E2EAAA
publicKeyToken, xrefs: 04E2EEEB, 04E2EF39
XPath, xrefs: 04E2E91B
xmlns:microsoftNs='urn:schemas-microsoft-com:asm.v1', xrefs: 04E2E9C1
%.8x%.8x, xrefs: 04E2F242
language, xrefs: 04E2ED64
type, xrefs: 04E2EE26, 04E2EE74

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ClearVariant$AllocString$CreateFullInitializeInstanceNamePath
String ID: %.8x%.8x$/microsoftNs:assembly/microsoftNs:assemblyIdentity$SelectionLanguage$SelectionNamespaces$XPath$culture$language$name$none$processorArchitecture$publicKeyToken$type$xmlns:microsoftNs='urn:schemas-microsoft-com:asm.v1'
API String ID: 2071324687-851432895
Opcode ID: e19bc62b834703ea8ec7956fb25509f58f0712401b7d577d59ecef01a92ec1a6
Instruction ID: ada70a5cf7c8b96cda665136bba61e8eddd6ae4ae3d6db12b45b102054ebfc6f
Opcode Fuzzy Hash: e19bc62b834703ea8ec7956fb25509f58f0712401b7d577d59ecef01a92ec1a6
Instruction Fuzzy Hash: 14622E726183519BD724EF64C890EAFB3E9FFD8208F544D1DE18997250EB70B905CBA2

Function 04E987D0 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 399memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,00102000,00000040,00000000,?,?,00000000), ref: 04E98806
VirtualAllocEx.KERNEL32(?,00000000,?,00101000,00000040), ref: 04E98821
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,00000000,?,?,00000000), ref: 04E98838
LoadLibraryA.KERNEL32(?), ref: 04E98957
GetProcAddress.KERNEL32(00000000), ref: 04E989AA
GetCurrentProcess.KERNEL32 ref: 04E98B2B
WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 04E98B5F
GetCurrentProcess.KERNEL32 ref: 04E98C08
VirtualQuery.KERNEL32(?,00000008,0000001C), ref: 04E98C28
VirtualProtect.KERNEL32(?,04E8ECE4,00000001,00000000), ref: 04E98C44
VirtualProtectEx.KERNEL32(?,?,04E8ECE4,00000001,00000000), ref: 04E98C5D
FlushInstructionCache.KERNEL32(?,?,?), ref: 04E98C94
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04E98CA2

Strings

, xrefs: 04E98BEC
Imported function, , xrefs: 04E98A10
@, xrefs: 04E98BF4
core, xrefs: 04E98A15

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Virtual$AllocProcess$CurrentProtect$AddressCacheFlushFreeInstructionLibraryLoadMemoryProcQueryWrite
String ID: $@$Imported function, $core
API String ID: 2182222620-3093977151
Opcode ID: 9cdb8cfb278b616e6a047cfd93800e9d55511613c0e194548cc965bb872d9a82
Instruction ID: b3cf256e0e8e636bea60a3f8dc4af5118f3ccedc4636f713f6128a00a19dbbf9
Opcode Fuzzy Hash: 9cdb8cfb278b616e6a047cfd93800e9d55511613c0e194548cc965bb872d9a82
Instruction Fuzzy Hash: 11E158B1A143019FDB24EF25C884A6AB7E5BF89708F04192DF98597391E774FC04CBA2

Function 04E500A0 Relevance: 30.3, APIs: 11, Strings: 9, Instructions: 334COMMON

Download Yara Rule

APIs

Part of subcall function 04DC1D60: memcpy.NTDLL(00000000,?,?,00000000), ref: 04DC1D95

Part of subcall function 04DC2610: memcpy.NTDLL(?,00000000,-00000001,00000000,?,?,00000000,04DC4D60,?), ref: 04DC264F

memcpy.NTDLL(00000000,?,-00000001,00000000,00000100,?), ref: 04E501EA
memcpy.NTDLL(00000000,-00000001,?,?,00000000,?,00000000,?,?), ref: 04E50226
memcpy.NTDLL(00000000,00000000,?,?,00000000,?,00000000,?,?), ref: 04E50286
memcpy.NTDLL(?,?,?,00000000,?,00000000,?,?), ref: 04E502AA
memcpy.NTDLL(00000000,NULL,-00000002,00000000,000000FF,?,?,?,?,00000000,?,00000000,?,?), ref: 04E50322
memcpy.NTDLL(00000000,-00000002,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04E5035E
memcpy.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04E503BA
memcpy.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 04E503DE
wsprintfA.USER32 ref: 04E503FE
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,?), ref: 04E5046D

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

memcpy.NTDLL(-00000001,?,-00000001,?,?,?,?,?,?,?,00000000,?,00000000,?,?), ref: 04E50499

Strings

NULL, xrefs: 04E502C7, 04E502EF, 04E50318
MemoryBasicInformation, xrefs: 04E500DB
MemoryWorkingSetExList, xrefs: 04E5011B
MemoryInformationClassUnknown, xrefs: 04E5012B
MemoryBasicVlmInformation, xrefs: 04E5010B
(0x%.8x), xrefs: 04E503F8
MemoryWorkingSetList, xrefs: 04E500EB
MemorySectionName, xrefs: 04E500FB
MemoryLoadedImageInformation, xrefs: 04E5013B

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: memcpy$FreeHeapwsprintf
String ID: (0x%.8x)$MemoryBasicInformation$MemoryBasicVlmInformation$MemoryInformationClassUnknown$MemoryLoadedImageInformation$MemorySectionName$MemoryWorkingSetExList$MemoryWorkingSetList$NULL
API String ID: 2972188138-3251939692
Opcode ID: 20bc957eeb406f241ec196118a36bff110b8d8ff8a74ed13c0cc03852547ddb8
Instruction ID: 67bc408252e384e313ef7e7994f5595b34970d83ecbbd79f8e8e0497c2b6a56f
Opcode Fuzzy Hash: 20bc957eeb406f241ec196118a36bff110b8d8ff8a74ed13c0cc03852547ddb8
Instruction Fuzzy Hash: B9C1CFB1904345ABEB21AF64DC80B2BB7E5BF8570CF54182DE88907282E771B955CB63

Function 04E6C0E0 Relevance: 19.5, APIs: 2, Strings: 9, Instructions: 213nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 04E6C100
ReadProcessMemory.KERNEL32(?,?,?,000001D8,?), ref: 04E6C11E

Part of subcall function 04E65FB0: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 04E65FCB

Strings

. Virtual exe: from , xrefs: 04E6C2AE
to , xrefs: 04E6C29E, 04E6C2BE
sysapi/process, xrefs: 04E6C2D8
- , xrefs: 04E6C183
Template: , xrefs: 04E6C193
TryCreateProcessForVirtualEXE, template exe found: , xrefs: 04E6C239, 04E6C376
Stub: from , xrefs: 04E6C2CE
Unsuitable combination of stub's and virtual exe's image bases / offsets., xrefs: 04E6C2D3
core, xrefs: 04E6C198, 04E6C23E, 04E6C37B

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Process$CreateFileInformationMemoryQueryRead
String ID: - $ to $. Virtual exe: from $Stub: from $Template: $TryCreateProcessForVirtualEXE, template exe found: $Unsuitable combination of stub's and virtual exe's image bases / offsets.$core$sysapi/process
API String ID: 2478325311-3865723307
Opcode ID: 0b7a388aea12e63ebc7d9d08fac449cc38f13ae9cea2f5624fa828ad9eaa7034
Instruction ID: 07ece7d302fdaf8af7fb8eb001373f5a7bfcd568477e91b20595b9ac4bc31172
Opcode Fuzzy Hash: 0b7a388aea12e63ebc7d9d08fac449cc38f13ae9cea2f5624fa828ad9eaa7034
Instruction Fuzzy Hash: 1F618031754301ABEA18FB74DC54DBF73A9EFC0708F90292DB88697290EE64BD058B91

Function 04DF8000 Relevance: 16.7, APIs: 11, Instructions: 212threadnativeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04DF800C
InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF802B
NtQueueApcThread.NTDLL(?,?,?,?,00000000), ref: 04DF8138
SetEvent.KERNEL32(?), ref: 04DF814C
SetEvent.KERNEL32(?), ref: 04DF817D
InterlockedExchange.KERNEL32(?,00000000), ref: 04DF81B7
InterlockedDecrement.KERNEL32(?), ref: 04DF81C8
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DF81D6
InterlockedExchange.KERNEL32(?,00000000), ref: 04DF8203
InterlockedDecrement.KERNEL32(?), ref: 04DF8214
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DF8222

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$DecrementEventReleaseSemaphoreThread$CompareCurrentQueue
String ID:
API String ID: 1502434316-0
Opcode ID: ec2583b8e0fc5a56a72e4667ac90ca3f04be7e52aac5d82aade266034bcf007d
Instruction ID: 889604e1658bafca30a35ea88cc13a99cd59ed422f20dba4e5a14c5254642049
Opcode Fuzzy Hash: ec2583b8e0fc5a56a72e4667ac90ca3f04be7e52aac5d82aade266034bcf007d
Instruction Fuzzy Hash: B1714875200201AFD724EF29DC84E6BB7A9FF88310F118609FA5587385DB34F945CBA2

Function 099E1368 Relevance: 12.8, Strings: 10, Instructions: 255COMMON

Download Yara Rule

Strings

\scq, xrefs: 099E1627
(ocq, xrefs: 099E1518
\scq, xrefs: 099E15FE
p<cq, xrefs: 099E13FC
\scq, xrefs: 099E14B6
pgq, xrefs: 099E145A
pgq, xrefs: 099E1436
\scq, xrefs: 099E14AC
p<cq, xrefs: 099E13BC
\scq, xrefs: 099E1631

Memory Dump Source

Source File: 00000009.00000002.2778595133.00000000099E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: true

Associated: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_99c0000_LisectAVT_2403002B_286_Update.jbxd

Yara matches

Similarity

API ID:
String ID: (ocq$\scq$\scq$\scq$\scq$\scq$p<cq$p<cq$pgq$pgq
API String ID: 0-515066795
Opcode ID: 08e937d549a775a9e8a0da798caacc86aec235f454506a1bab6e5665b85e51dc
Instruction ID: e883bf12dd90093b2f00207d5239443a60a1a77dac1b6dfd53dfa2497a87a452
Opcode Fuzzy Hash: 08e937d549a775a9e8a0da798caacc86aec235f454506a1bab6e5665b85e51dc
Instruction Fuzzy Hash: 2F91D572F001298BCB15DFADD8456AEF7E6ABC8314B5A447ADC05EB390EA31DC018BD0

Function 099E0040 Relevance: 10.3, Strings: 8, Instructions: 347COMMON

Download Yara Rule

Strings

pgq, xrefs: 099E00F0
pgq, xrefs: 099E032A
(ocq, xrefs: 099E0377
pgq, xrefs: 099E011E
\;cq, xrefs: 099E00A1
&Y5f, xrefs: 099E034E
(ocq, xrefs: 099E036B
pgq, xrefs: 099E0336

Memory Dump Source

Source File: 00000009.00000002.2778595133.00000000099E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 099C0000, based on PE: true

Associated: 00000009.00000002.2778525625.00000000099C0000.00000004.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_99c0000_LisectAVT_2403002B_286_Update.jbxd

Yara matches

Similarity

API ID:
String ID: &Y5f$(ocq$(ocq$\;cq$pgq$pgq$pgq$pgq
API String ID: 0-4011464909
Opcode ID: 4e2c0b9db9c64fb6fe0250263accb9fee3ea8bbbbe86a24f88156e9ff8326671
Instruction ID: 4b2ed25ed443a1379c78f91d4d1529350eed4674032330b21c91c9a12e7cd2fb
Opcode Fuzzy Hash: 4e2c0b9db9c64fb6fe0250263accb9fee3ea8bbbbe86a24f88156e9ff8326671
Instruction Fuzzy Hash: 34C1F272F041298FCB16DE79C8504AEB6E7AFC8350B59856AD849EB394EA70CC41CBD1

Function 04E660F0 Relevance: 6.0, APIs: 4, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,75935030), ref: 04E6610E
ReadProcessMemory.KERNEL32(?,?,?,000001D8,?), ref: 04E66132
ReadProcessMemory.KERNEL32(?,?,?,00000040,?), ref: 04E66149
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 04E66169

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Process$MemoryRead$InformationQuery
String ID:
API String ID: 3059065599-0
Opcode ID: 961160c5b64acb5f61763cdb20acbf17f25d49788114bbb57e437ac75933eb22
Instruction ID: 7582063e729df5344948ad8fb680ffccd47808147aebc5d70a69492b4be7008b
Opcode Fuzzy Hash: 961160c5b64acb5f61763cdb20acbf17f25d49788114bbb57e437ac75933eb22
Instruction Fuzzy Hash: 20010C75215345AFE215DA45DC81EEFB3EDEFC8700F10891DF68453180D6B4AA068BA2

Function 04E8E010 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ExchangeInterlocked
String ID:
API String ID: 367298776-0
Opcode ID: 8ef4cf6706e7a4fa53f0d4a9940bbf5274e69ef7ae1f03ad2b8bc1974c1b75b7
Instruction ID: 53eab1354289455230aba95c9fe9c5de81cae2f09f7f9dffa11735426dedef69
Opcode Fuzzy Hash: 8ef4cf6706e7a4fa53f0d4a9940bbf5274e69ef7ae1f03ad2b8bc1974c1b75b7
Instruction Fuzzy Hash: FCC002742002009FC644EBA8C594A6AB3E5BBD8345F505679A459C7355CA34AC01CB51

Function 04E4E6F0 Relevance: 39.3, APIs: 7, Strings: 19, Instructions: 272COMMON

Download Yara Rule

APIs

Part of subcall function 04DC1D60: memcpy.NTDLL(00000000,?,?,00000000), ref: 04DC1D95

Part of subcall function 04DC2610: memcpy.NTDLL(?,00000000,-00000001,00000000,?,?,00000000,04DC4D60,?), ref: 04DC264F

memcpy.NTDLL(00000000,00000000,?,?), ref: 04E4E8DD
memcpy.NTDLL(00000001,00000001,-00000001,?), ref: 04E4E90F

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

memcpy.NTDLL(00000000,NULL,-00000002,00000000,000000FF,?), ref: 04E4E991
memcpy.NTDLL(00000000,-00000002,?,?,00000000,?,00000000,?,?), ref: 04E4E9C7
memcpy.NTDLL(00000000,00000000,?,?,00000000,?,00000000,?,?), ref: 04E4EA36
memcpy.NTDLL(00000000,00000000,?,00000000,?,00000000,?,?), ref: 04E4EA58
wsprintfA.USER32 ref: 04E4EA90

Strings

FILE_SYNCHRONOUS_IO_NONALERT, xrefs: 04E4E7A1
@, xrefs: 04E4E739
FILE_NO_EA_KNOWLEDGE, xrefs: 04E4E7D4
FILE_SEQUENTIAL_ONLY, xrefs: 04E4E761
FILE_COMPLETE_IF_OPLOCKED, xrefs: 04E4E7C1
NULL, xrefs: 04E4E936, 04E4E95F, 04E4E987
FILE_DELETE_ON_CLOSE, xrefs: 04E4E7EA
FILE_NON_DIRECTORY_FILE, xrefs: 04E4E741
FILE_OPEN_BY_FILE_ID, xrefs: 04E4E800
FILE_SYNCHRONOUS_IO_ALERT, xrefs: 04E4E791
FILE_NO_INTERMEDIATE_BUFFERING, xrefs: 04E4E781
FILE_WRITE_THROUGH, xrefs: 04E4E751
FILE_RANDOM_ACCESS, xrefs: 04E4E771
FILE_OPEN_FOR_BACKUP_INTENT, xrefs: 04E4E816
FILE_DIRECTORY_FILE, xrefs: 04E4E731
0x%.8x, xrefs: 04E4EA8A
| , xrefs: 04E4E870, 04E4EA9E
FILE_CREATE_TREE_CONNECTION, xrefs: 04E4E7B1
, xrefs: 04E4E799

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: memcpy$FreeHeapwsprintf
String ID: $ | $0x%.8x$@$FILE_COMPLETE_IF_OPLOCKED$FILE_CREATE_TREE_CONNECTION$FILE_DELETE_ON_CLOSE$FILE_DIRECTORY_FILE$FILE_NON_DIRECTORY_FILE$FILE_NO_EA_KNOWLEDGE$FILE_NO_INTERMEDIATE_BUFFERING$FILE_OPEN_BY_FILE_ID$FILE_OPEN_FOR_BACKUP_INTENT$FILE_RANDOM_ACCESS$FILE_SEQUENTIAL_ONLY$FILE_SYNCHRONOUS_IO_ALERT$FILE_SYNCHRONOUS_IO_NONALERT$FILE_WRITE_THROUGH$NULL
API String ID: 2972188138-2410351185
Opcode ID: 05e3c1d5fceddc2d7a95ab09ebec3e19ccedadc6d03bc7282037036fa37727f5
Instruction ID: a401e8b425e9aac54311f5d88ab3a518bf046336f568404743b6887c62fd2335
Opcode Fuzzy Hash: 05e3c1d5fceddc2d7a95ab09ebec3e19ccedadc6d03bc7282037036fa37727f5
Instruction Fuzzy Hash: 4EA19EB1A043419FEB20EF19E88176BBBE5BFC4308F04582DE5894B282D775F958CB52

Function 04E68610 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 133libraryloaderregistryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 04E6861A
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E6862E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E68640
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E68646
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E68651
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 04E68673
GetProcAddress.KERNEL32(00000000,DllUnregisterServer), ref: 04E6867F
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 04E686A5
RegDeleteKeyW.ADVAPI32(80000002,SOFTWARE\Macromedia\FlashPlayer\SafeVersions), ref: 04E68721
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E6877A
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,04E8E8E4,?), ref: 04E68784

Strings

DllRegisterServer, xrefs: 04E6866D
E, xrefs: 04E686E9
SOFTWARE\Macromedia\FlashPlayer\SafeVersions, xrefs: 04E68717, 04E68736
DllGetClassObject, xrefs: 04E6869F
T, xrefs: 04E686F3
D, xrefs: 04E686E4
DllUnregisterServer, xrefs: 04E68675
S, xrefs: 04E686EE

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: AddressErrorLastProc$Library$DeleteFreeInitializeLoadUninitialize
String ID: D$DllGetClassObject$DllRegisterServer$DllUnregisterServer$E$S$SOFTWARE\Macromedia\FlashPlayer\SafeVersions$T
API String ID: 759782565-3733902375
Opcode ID: b086bae6c722221a7ee523bbff1eeeb0e38852d64a3753ccf3776a8eee8b207e
Instruction ID: 565380c2d75a0b311775917ba37f13009e9c144b3a3149da31b43c648788f5ca
Opcode Fuzzy Hash: b086bae6c722221a7ee523bbff1eeeb0e38852d64a3753ccf3776a8eee8b207e
Instruction Fuzzy Hash: 9041CC31244301AFC300EF6ACC80E6BBBE4FFC8655F14591EF998C7291DA75E9058BA2

Function 04E4A740 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 211COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 04E4A748
CoRegisterSurrogate.OLE32(?), ref: 04E4A7AE
CoUninitialize.OLE32 ref: 04E4A7B8

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

Strings

BoxedApp::COMSurrogate::DefaultSurrogateHandler, xrefs: 04E4A76F, 04E4A7D7
/Processid:, xrefs: 04E4A831
(): CoInitializeEx failed, xrefs: 04E4A76A
(): CoRegisterSurrogate failed, xrefs: 04E4A7D2
core, xrefs: 04E4A774, 04E4A7DC

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$FileInitializeLocalPrintProcessRegisterSurrogateThreadTimeUninitializeWrite
String ID: (): CoInitializeEx failed$(): CoRegisterSurrogate failed$/Processid:$BoxedApp::COMSurrogate::DefaultSurrogateHandler$core
API String ID: 789884646-1305326877
Opcode ID: 1bec09ba164972a138877aa2cf344ed5845c452c0f066450138f47049fc07483
Instruction ID: 0c47fd0cf6ee9e7f67581b0b0b193691ffd267360af58ef24d1bec6cf0a4918a
Opcode Fuzzy Hash: 1bec09ba164972a138877aa2cf344ed5845c452c0f066450138f47049fc07483
Instruction Fuzzy Hash: EF719FB1A48300ABD710EFA5EC8086FB7E9AFD4618F44292DF54287290EB35FD05CB52

Function 04E5A720 Relevance: 21.1, APIs: 14, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,00000020,?,?,?,?,?,04E5B3BF,?,?), ref: 04E5A75A
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A76C
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A772
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A77A
UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A794
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7AA
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7BD
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7C3
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7C9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7DF
VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A7F5
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A805
GetLastError.KERNEL32(?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A80B
CloseHandle.KERNEL32(00000000,?,?,?,?,?,04E5B3BF,?,?,00000118,00000000), ref: 04E5A81E

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$File$CloseHandleView$CreateMappingQueryUnmapVirtual
String ID:
API String ID: 3925098678-0
Opcode ID: cd60c547be64c6b91d5db6e0bc971274c3e1cb6d2846208048a78e1330bd636c
Instruction ID: c4c5727911118793ee23164a9b34f362555ffe711a8d068c9fa2828d75d50247
Opcode Fuzzy Hash: cd60c547be64c6b91d5db6e0bc971274c3e1cb6d2846208048a78e1330bd636c
Instruction Fuzzy Hash: 9931E4327006216BE730AA29DC40F6A37F5EF44B24F54073AEE45D72E0EA69FC014AA1

Function 04E4E4A0 Relevance: 18.2, APIs: 5, Strings: 7, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 04DC1D60: memcpy.NTDLL(00000000,?,?,00000000), ref: 04DC1D95

wsprintfA.USER32 ref: 04E4E53D

Part of subcall function 04DC2610: memcpy.NTDLL(?,00000000,-00000001,00000000,?,?,00000000,04DC4D60,?), ref: 04DC264F

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

memcpy.NTDLL(00000000,?,-00000001,00000000,00000100,?,?,00000000,?,?), ref: 04E4E5FC
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,?,00000000,?,?), ref: 04E4E63C
memcpy.NTDLL(00000000,?,?,?,?,?,?,?,?,00000000,?,?), ref: 04E4E6AA
memcpy.NTDLL(?,?,?,?,?,?,?,?,00000000,?,?), ref: 04E4E6CC

Strings

FILE_OVERWRITE_IF, xrefs: 04E4E535
FILE_OPEN, xrefs: 04E4E505
FILE_SUPERSEDE, xrefs: 04E4E4E5
FILE_OPEN_IF, xrefs: 04E4E515
FILE_CREATE, xrefs: 04E4E4F5
0x%.8x, xrefs: 04E4E4D9
FILE_OVERWRITE, xrefs: 04E4E525

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: memcpy$FreeHeapwsprintf
String ID: 0x%.8x$FILE_CREATE$FILE_OPEN$FILE_OPEN_IF$FILE_OVERWRITE$FILE_OVERWRITE_IF$FILE_SUPERSEDE
API String ID: 2972188138-2495305306
Opcode ID: eca6f66e36d99f33f522c97c3186048698cb0615a129a2e6225245c006ee2a42
Instruction ID: b1c05591429022aa373379549e97dd765fd705f61f0aefe624aad1f14e649af3
Opcode Fuzzy Hash: eca6f66e36d99f33f522c97c3186048698cb0615a129a2e6225245c006ee2a42
Instruction Fuzzy Hash: 6461D2B1904341ABD720AF59E880B5BBBE4FFD4308F44582DE58947242E776F958CBA3

Function 04E50510 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 115timethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 04DC1CF0: memcpy.NTDLL(00000000,00000001,?,?,?,00000000,?,?,?,?,?,04E2C505,?,?,?,?), ref: 04DC1D36

GetLocalTime.KERNEL32 ref: 04E50559

Part of subcall function 04DF93B0: memcpy.NTDLL(00000000,75922E80,00000002,75922E80,?,75922EF0,00000000,?,04E5056B,bx:), ref: 04DF93F1

Part of subcall function 04E4F6B0: wsprintfA.USER32 ref: 04E4F6C8

GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
GetCurrentThreadId.KERNEL32 ref: 04E50644

Strings

error, xrefs: 04E50531
warn, xrefs: 04E50539
bx:, xrefs: 04E5055F
trace, xrefs: 04E50551
info, xrefs: 04E50541
debug, xrefs: 04E50549

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Currentmemcpy$LocalProcessThreadTimewsprintf
String ID: bx:$debug$error$info$trace$warn
API String ID: 3941987465-2600430018
Opcode ID: ba8e2ccf3d6f29a359e4a45ca59bb97977b54b1142e4771ab5930455a6448f6d
Instruction ID: 7af6797d28abb0b5412af4026c0f43b068788a11f37fd2b3264839afaa699258
Opcode Fuzzy Hash: ba8e2ccf3d6f29a359e4a45ca59bb97977b54b1142e4771ab5930455a6448f6d
Instruction Fuzzy Hash: 463184E1304620676A09BF25486293FB6D7DFC8904705144DF68A8B3E4DF78AC02DBE3

Function 04E94410 Relevance: 15.1, APIs: 10, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00004000), ref: 04E94488
HeapAlloc.KERNEL32(00000000), ref: 04E9448F
InterlockedIncrement.KERNEL32(00000004), ref: 04E944A6
InterlockedDecrement.KERNEL32(?), ref: 04E944BD
GetProcessHeap.KERNEL32(00000000), ref: 04E944CD
HeapFree.KERNEL32(00000000), ref: 04E944D4
InterlockedIncrement.KERNEL32(00000004), ref: 04E944F9
InterlockedDecrement.KERNEL32(00000004), ref: 04E94500
GetProcessHeap.KERNEL32(00000000), ref: 04E94510
HeapFree.KERNEL32(00000000), ref: 04E94517

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Heap$Interlocked$Process$DecrementFreeIncrement$Alloc
String ID:
API String ID: 1856492253-0
Opcode ID: 8c7ec4f5404d1614f83852e76b22e12d1c3fdf72eb9bba2ef5f5b478c1413cea
Instruction ID: 2d3290311a9a087f4ae26122d2a921d66a94104a73510a6db63976adc2cdd226
Opcode Fuzzy Hash: 8c7ec4f5404d1614f83852e76b22e12d1c3fdf72eb9bba2ef5f5b478c1413cea
Instruction Fuzzy Hash: 023193B6908315ABDB10DF94FC84B6AB7E4FB84B05F00452AF905972C5DB74ED06CBA2

Function 04E9445E Relevance: 15.1, APIs: 10, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00004000), ref: 04E94488
HeapAlloc.KERNEL32(00000000), ref: 04E9448F

Part of subcall function 04E93F10: RtlZeroMemory.NTDLL(00000000,00000008), ref: 04E93F1A

InterlockedIncrement.KERNEL32(00000004), ref: 04E944A6
InterlockedDecrement.KERNEL32(?), ref: 04E944BD
GetProcessHeap.KERNEL32(00000000), ref: 04E944CD
HeapFree.KERNEL32(00000000), ref: 04E944D4
InterlockedIncrement.KERNEL32(00000004), ref: 04E944F9
InterlockedDecrement.KERNEL32(00000004), ref: 04E94500
GetProcessHeap.KERNEL32(00000000), ref: 04E94510
HeapFree.KERNEL32(00000000), ref: 04E94517

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Heap$Interlocked$Process$DecrementFreeIncrement$AllocMemoryZero
String ID:
API String ID: 3686117956-0
Opcode ID: 63966bee0015fa910e38ab8e461b66dd3dd9adfa88233815466841d6df1a339e
Instruction ID: f56f6e26a20c1940c2b7561794d00ecf13854233cb1a4fb71b1cee25780c4484
Opcode Fuzzy Hash: 63966bee0015fa910e38ab8e461b66dd3dd9adfa88233815466841d6df1a339e
Instruction Fuzzy Hash: BF2190B6804315ABE710DFA0FC88F6A77A5FF84706F004419FA09972C5DB78AD16CB62

Function 04DDE520 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00130089,00000000,00000000), ref: 04DDE59D
GetCurrentProcess.KERNEL32(?,00000000), ref: 04DDE5A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000), ref: 04DDE5BE
GetCurrentProcess.KERNEL32(?,00000000), ref: 04DDE5C2

Strings

", xrefs: 04DDE5AB

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CurrentProcess
String ID: "
API String ID: 2050909247-123907689
Opcode ID: 7ee0fd24680ceb01d8b23338206b59f443d46dfe929d554349ad3e5f8740ae7b
Instruction ID: eeef48d0c84b0b1517c7ffd54386ae0d19a54f044107d72c5de78d2a127bd6d3
Opcode Fuzzy Hash: 7ee0fd24680ceb01d8b23338206b59f443d46dfe929d554349ad3e5f8740ae7b
Instruction Fuzzy Hash: 64D14E71204341ABE725EB64CC94FABB3E9EFC4744F00491DB6899B190EE74F909C7A2

Function 04E0A6F0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8EF0: InterlockedExchange.KERNEL32(00000008,00000000), ref: 04DC8F38
Part of subcall function 04DC8EF0: InterlockedDecrement.KERNEL32(0000000C), ref: 04DC8F49
Part of subcall function 04DC8EF0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DC8F5B

GetCurrentProcess.KERNEL32(?,00000000), ref: 04E0A774
GetCurrentProcess.KERNEL32(?,00000000), ref: 04E0A778
CloseHandle.KERNEL32(?), ref: 04E0A87A

Part of subcall function 04E4F790: wsprintfA.USER32 ref: 04E4F967
Part of subcall function 04E4F790: memcpy.NTDLL(00000000,-00000001,?), ref: 04E4FA06
Part of subcall function 04E4F790: wsprintfA.USER32 ref: 04E4FAAD

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

Strings

BoxedApp::FileSystem::Layers::CSandboxDirectoryLayer::DuplicateHandleInformation, xrefs: 04E0A7CA
: NtDuplicateObject() failed to duplicate sandbox handle , xrefs: 04E0A7C5
, status = , xrefs: 04E0A7B5
layer/sandbox, xrefs: 04E0A7CF

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$Process$Interlockedwsprintf$CloseDecrementExchangeFileFreeHandleHeapLocalPrintReleaseSemaphoreThreadTimeWritememcpy
String ID: , status = $: NtDuplicateObject() failed to duplicate sandbox handle $BoxedApp::FileSystem::Layers::CSandboxDirectoryLayer::DuplicateHandleInformation$layer/sandbox
API String ID: 1741710999-4203240436
Opcode ID: 88396c773bd14c4258a9d394b3ffc06949c07cd379832f731d6e946697ed8251
Instruction ID: faf508d03d4a91272367d5529154a8718b476a6765d928e7db6c61440eff54c8
Opcode Fuzzy Hash: 88396c773bd14c4258a9d394b3ffc06949c07cd379832f731d6e946697ed8251
Instruction Fuzzy Hash: 8441B171604300ABD714EB68DC84DAFB3E9AFD4308F049A2DF55697290EB71FC468B62

Function 04E3C0F0 Relevance: 12.3, APIs: 8, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 04E405D0: InterlockedIncrement.KERNEL32 ref: 04E40637

InterlockedIncrement.KERNEL32(?), ref: 04E3C184
InterlockedIncrement.KERNEL32(00000000), ref: 04E3C1EB
InterlockedIncrement.KERNEL32(00000000), ref: 04E3C278

Part of subcall function 04E3BFC0: InterlockedIncrement.KERNEL32(?), ref: 04E3C034
Part of subcall function 04E3BFC0: InterlockedIncrement.KERNEL32(00000000), ref: 04E3C0C8

InterlockedIncrement.KERNEL32(00000000), ref: 04E3C322
InterlockedIncrement.KERNEL32(00000000), ref: 04E3C3AB
InterlockedDecrement.KERNEL32(?), ref: 04E3C3C4
InterlockedDecrement.KERNEL32(00000000), ref: 04E3C433
InterlockedDecrement.KERNEL32(?), ref: 04E3C46D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Increment$Decrement
String ID:
API String ID: 4289621856-0
Opcode ID: 384441fa6c146916c4b592ec150dcab150b18e8613e077a5b21ae92d16dc2dda
Instruction ID: baa613dd2fd91fff7aaa4b29770f0ff483a0fd45eca48bcde21103371728fc5e
Opcode Fuzzy Hash: 384441fa6c146916c4b592ec150dcab150b18e8613e077a5b21ae92d16dc2dda
Instruction Fuzzy Hash: 80C11972508310AFD711EF65D884C6BB7E9FF88609F50692EF589A3250DB30F945CBA2

Function 04E3A5F0 Relevance: 12.2, APIs: 8, Instructions: 220COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 04E3A65B
InterlockedIncrement.KERNEL32(?), ref: 04E3A6A9
InterlockedDecrement.KERNEL32(00000000), ref: 04E3A6C7
InterlockedDecrement.KERNEL32(00000000), ref: 04E3A70E
InterlockedDecrement.KERNEL32(?), ref: 04E3A73E
InterlockedIncrement.KERNEL32(00000000), ref: 04E3A78D
InterlockedDecrement.KERNEL32(?), ref: 04E3A798
InterlockedDecrement.KERNEL32(?), ref: 04E3A81A

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID:
API String ID: 2574743344-0
Opcode ID: 34058a619b09814baf4ed218bf5f7790ce860d3e654be8392a9827475e7c6d5c
Instruction ID: b2845f548b1b9308e3782d75f04ffb529801661182d0fe342819508f5857f22a
Opcode Fuzzy Hash: 34058a619b09814baf4ed218bf5f7790ce860d3e654be8392a9827475e7c6d5c
Instruction Fuzzy Hash: 4D711F75604304AFD711EF66D888C6FB7E9EF88A09B40692DF48997240DB34FD81CB66

Function 04E98010 Relevance: 12.2, APIs: 8, Instructions: 198stringCOMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,00000040,00000000,00000000,?,?,00000000), ref: 04E98046
ReadProcessMemory.KERNEL32(?,?,?,000000F8,?), ref: 04E98065
ReadProcessMemory.KERNEL32(?,?,?,00000028,?), ref: 04E9807E
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 04E980C2
ReadProcessMemory.KERNEL32(?,?,?,00000001,?), ref: 04E98115
lstrcmpA.KERNEL32(00000000,?), ref: 04E9815F

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: MemoryProcessRead$lstrcmp
String ID:
API String ID: 1270094187-0
Opcode ID: 6fd5dc1121f554cc40c6489a5f2c11328e77937bc4079fa34fab7e1322e327f2
Instruction ID: 6aec463186cdba987afbf186000eadc160a4f732aa0a5bc4e031806655ad0fe8
Opcode Fuzzy Hash: 6fd5dc1121f554cc40c6489a5f2c11328e77937bc4079fa34fab7e1322e327f2
Instruction Fuzzy Hash: 60619272208345ABD710DF55DC40AABB7E8FBC5758F04491EF58983290D775E909CBA2

Function 04E6A560 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

TlsGetValue.KERNEL32(00000014), ref: 04E6A573

Part of subcall function 04E30AE0: GetLastError.KERNEL32(00000000,04E66E83,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AE3
Part of subcall function 04E30AE0: SetLastError.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AEE

Strings

): , xrefs: 04E6A67B
, IoStatusBlock->Status = , xrefs: 04E6A66B
, IoStatusBlock->Information = , xrefs: 04E6A657
, CompletionKey = , xrefs: 04E6A645
, CompletionValue = , xrefs: 04E6A632
NtRemoveIoCompletion(IoCompletionHandle: , xrefs: 04E6A68B
core, xrefs: 04E6A690

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$Value
String ID: ): $, CompletionKey = $, CompletionValue = $, IoStatusBlock->Information = $, IoStatusBlock->Status = $NtRemoveIoCompletion(IoCompletionHandle: $core
API String ID: 1883355122-3553767507
Opcode ID: cff60ac8840032f44e93bf64f40ec3b51d0d80350db36a12544f275fe537403f
Instruction ID: edd9cf2fcc89441399ddae9f4675e8bb775b801330e8d6dced19d2145f799d6f
Opcode Fuzzy Hash: cff60ac8840032f44e93bf64f40ec3b51d0d80350db36a12544f275fe537403f
Instruction Fuzzy Hash: 9D514EB1A04350ABDA14EB64D880D5FB7E9AFC4B08F105D2EF586D7291EA74FD04CB92

Function 04E90000 Relevance: 10.6, APIs: 7, Instructions: 129memorythreadinjectionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 04E900AA
HeapFree.KERNEL32(00000000), ref: 04E900B1
GetCurrentProcess.KERNEL32(04EC8928,00000002,00000000,00000000), ref: 04E90161
GetCurrentThread.KERNEL32 ref: 04E90164
GetCurrentProcess.KERNEL32(00000000), ref: 04E9016B

Part of subcall function 04E3FD70: InterlockedExchange.KERNEL32(?,00000000), ref: 04E3FD8F
Part of subcall function 04E3FD70: InterlockedDecrement.KERNEL32(?), ref: 04E3FDA0
Part of subcall function 04E3FD70: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E3FDAE

DuplicateHandle.KERNEL32(00000000), ref: 04E9016E
SuspendThread.KERNEL32(00000000), ref: 04E9017A

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CurrentProcess$HeapInterlockedThread$DecrementDuplicateExchangeFreeHandleReleaseSemaphoreSuspend
String ID:
API String ID: 1086781611-0
Opcode ID: 7e873aeb16faccabed3e796a19b1d37b3d4000b68d0b9010aa587888ea843c6e
Instruction ID: 986a0a08d5edeb81a4d3c7355a6f740df210694b007cf2fc0afd3166d038a2f3
Opcode Fuzzy Hash: 7e873aeb16faccabed3e796a19b1d37b3d4000b68d0b9010aa587888ea843c6e
Instruction Fuzzy Hash: D5419275600205AFDB24EF66ED44F2B77E9FB8830AF445529E90887285CB39FC42CB52

Function 04E6A1C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117fileCOMMON

Download Yara Rule

APIs

Part of subcall function 04E98E10: GetWindowsDirectoryW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,04E6C4F2), ref: 04E98E3C
Part of subcall function 04E98E10: GetWindowsDirectoryW.KERNEL32(00000000,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,04E6C4F2), ref: 04E98E6F

Part of subcall function 04DC25C0: memcpy.NTDLL(?,00000001,00000002,00000000,?,?,00000000,04E99058,?), ref: 04DC2601

WriteFile.KERNEL32(00000000,04EC0488,00004000,00000000,00000000,?,40000000,00000001,00000000,00000002,00000000,00000000,?,?,?,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll), ref: 04E6A263
CloseHandle.KERNEL32(00000000,?,?,?,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll), ref: 04E6A26C
WriteFile.KERNEL32(00000000,04EC0488,00004000,00000001,00000000,?,40000000,00000001,00000000,00000002,00000000,00000000,?,?,?,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll), ref: 04E6A2AD
CloseHandle.KERNEL32(00000000,?,?,?,\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll), ref: 04E6A2B0

Part of subcall function 04DC3F20: memcpy.NTDLL(?,00000000,00000000,00000000,00000000,00000000,000000AC,00000FA0,00000000,04E28E60,?,?,02D206E0,\REGISTRY\USER\,\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID,\REGISTRY\MACHINE\Software\Classes\Wow6432Node\AppID), ref: 04DC3F74
Part of subcall function 04DC3F20: memcpy.NTDLL(00000000,?,04EA44E6,?,00000000,00000000,00000000,00000000,00000000,000000AC,00000FA0,00000000,04E28E60,?,?,02D206E0), ref: 04DC3F8A

Strings

\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll, xrefs: 04E6A1D3
\.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll, xrefs: 04E6A1ED

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: memcpy$CloseDirectoryFileHandleWindowsWrite
String ID: \.NETFramework\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll$\assembly\GAC\BoxedAppSDK_AppDomainManager\1.0.0.0__ef07ce3257ee81c1\BoxedAppSDK_AppDomainManager.dll
API String ID: 2332119604-4250271233
Opcode ID: 32378aacb24034b499cb7fa9382666245d52e404291ccb7453810d86cbd322aa
Instruction ID: 0c14696c078286b1fd6f142ccbd65b4b38d4332e19660bd83bbb55ba441bbbd4
Opcode Fuzzy Hash: 32378aacb24034b499cb7fa9382666245d52e404291ccb7453810d86cbd322aa
Instruction Fuzzy Hash: C331D4B2A443057BD600EF55EC81E5B77ECEB85648F001D2DF54693181EA35FE088AB7

Function 04E047E0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,04E0495E,?,?,?,?,?), ref: 04E04894
InterlockedIncrement.KERNEL32(04EC88F4), ref: 04E048BD

Strings

constructed, xrefs: 04E048DE
BoxedApp::FileSystem::Utils::Impl::CRealFileNotificationManager::CRealFileNotificationManager, xrefs: 04E048E9
core, xrefs: 04E048EE
: listener id , xrefs: 04E048E4

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CreateEventIncrementInterlocked
String ID: constructed$: listener id $BoxedApp::FileSystem::Utils::Impl::CRealFileNotificationManager::CRealFileNotificationManager$core
API String ID: 3999195403-3051967129
Opcode ID: e276ba8b758116ecdfee46401a09b95f3eacae64ddb8caff3a3c0eafad67a56f
Instruction ID: 53090f0059fa2ea51c5f296678dfc7b6942d624166240162affcb48f278b571b
Opcode Fuzzy Hash: e276ba8b758116ecdfee46401a09b95f3eacae64ddb8caff3a3c0eafad67a56f
Instruction Fuzzy Hash: 7F4126B0A007409FD320DF2AD98091BFBF4BF88708B005A2EE59A87BA0D770F840CB51

Function 0043F7AB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,0043F85B,?,0043AE22), ref: 0043F7B8
TlsGetValue.KERNEL32(00000005,?,0043AE22), ref: 0043F7CF
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0043AE22), ref: 0043F7E4
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0043F7FF

Strings

DecodePointer, xrefs: 0043F7F9
KERNEL32.DLL, xrefs: 0043F7DF

Memory Dump Source

Source File: 00000009.00000002.2755614298.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2755550332.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755670835.0000000000452000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755732116.000000000046B000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.000000000046D000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000570000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000576000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2755789074.0000000000583000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756191692.000000000059F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756263555.00000000005A3000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000762000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000009.00000002.2756443791.0000000000907000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: 88f913852e08c1575371cd1b3d4c95e2569a501468fffc6810ca2a17cca08315
Instruction ID: 245ecc31fb8c1607d4a4382ea1dab8f694e76174c75a8ccf15531d552fbd5d54
Opcode Fuzzy Hash: 88f913852e08c1575371cd1b3d4c95e2569a501468fffc6810ca2a17cca08315
Instruction Fuzzy Hash: DCF02B30A002139B86296B35EE00A5F3AD4DF09751F155537FC14D23F2EB68CD468A9D

Function 04E2A040 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 404stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 04E2A04E

Part of subcall function 04DC4D00: wsprintfA.USER32 ref: 04DC4D3D

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

Strings

BoxedApp::Registry::ReadonlyRegistry::CTree::MarshalInterface, xrefs: 04E2A09F, 04E2A159, 04E2A218, 04E2A2CD, 04E2A36C, 04E2A415, 04E2A4C5
: error: failed to query IMarshal from VariablesValueProvider, hr = , xrefs: 04E2A213
: error: IStream::Write() failed, hr = , xrefs: 04E2A09A, 04E2A154, 04E2A367, 04E2A4C0
: error: IMarshal::MarshalInterface() of VariablesValueProvider failed, hr = , xrefs: 04E2A2C8, 04E2A410
core, xrefs: 04E2A0A4, 04E2A15E, 04E2A21D, 04E2A2D2, 04E2A371, 04E2A41A, 04E2A4CA

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$FileFreeHeapLocalPrintProcessThreadTimeWritelstrlenwsprintf
String ID: : error: IMarshal::MarshalInterface() of VariablesValueProvider failed, hr = $: error: IStream::Write() failed, hr = $: error: failed to query IMarshal from VariablesValueProvider, hr = $BoxedApp::Registry::ReadonlyRegistry::CTree::MarshalInterface$core
API String ID: 1620325959-2442970054
Opcode ID: 08ae35d2f22fbfcbe6517a534fee4dd822383b0d7fae9330e9df94245f98848b
Instruction ID: 15a6276e333c359a1ae16820649a9e2acf64ef769170f50c057e20c5ea5d3c32
Opcode Fuzzy Hash: 08ae35d2f22fbfcbe6517a534fee4dd822383b0d7fae9330e9df94245f98848b
Instruction Fuzzy Hash: EBD16C71340301ABD608FB68DC90E7FB3E5EFC4608F50592CB5469B291EE64FD058BA5

Function 04E9A770 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 04E9A8B6
GetLastError.KERNEL32 ref: 04E9A8BC
GetLastError.KERNEL32 ref: 04E9A8C3

Strings

CommonProgramW6432, xrefs: 04E9A8D9
ProgramW6432, xrefs: 04E9A89B
:, xrefs: 04E9A7B4

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast
String ID: :$CommonProgramW6432$ProgramW6432
API String ID: 1452528299-594665369
Opcode ID: 35fc55da2d9f46e5acee8eb1ce875ab49d968083951f827688fa519bc1023e0e
Instruction ID: c04797ff42fa5f30479e4257553c3f823cc75b8370119191f0eee092b638de79
Opcode Fuzzy Hash: 35fc55da2d9f46e5acee8eb1ce875ab49d968083951f827688fa519bc1023e0e
Instruction Fuzzy Hash: 89915776E942406BEA00F768EC529DF77E8AF84718FC80429FE4C462D0F566BD1496E3

Function 04E7C1D0 Relevance: 9.2, APIs: 6, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8AC0: GetCurrentThreadId.KERNEL32 ref: 04DC8ACB
Part of subcall function 04DC8AC0: InterlockedCompareExchange.KERNEL32(02D20E84,00000000), ref: 04DC8AE6

InterlockedExchange.KERNEL32(00000008,00000000), ref: 04E7C20D
InterlockedDecrement.KERNEL32(0000000C), ref: 04E7C21E
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7C230
InterlockedExchange.KERNEL32(?,00000000), ref: 04E7C34C
InterlockedDecrement.KERNEL32(?), ref: 04E7C35D
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7C36F

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$DecrementReleaseSemaphore$CompareCurrentThread
String ID:
API String ID: 1308783253-0
Opcode ID: bb319dfcde82888fb41808cdf8f91508d7cb16276afcaa3abfe55f80dd7172cf
Instruction ID: 08229b3bcf4e9a8ea94f9671e8bbb885a1ae7c19e4728202718d0aaf51cd1a0f
Opcode Fuzzy Hash: bb319dfcde82888fb41808cdf8f91508d7cb16276afcaa3abfe55f80dd7172cf
Instruction Fuzzy Hash: 58516770610B01EFC764DF69D584B96B3E9FF88324F109A1EE94A87A90D770F884CB94

Function 04E7C450 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8AC0: GetCurrentThreadId.KERNEL32 ref: 04DC8ACB
Part of subcall function 04DC8AC0: InterlockedCompareExchange.KERNEL32(02D20E84,00000000), ref: 04DC8AE6

InterlockedExchange.KERNEL32(?,00000000), ref: 04E7C493
InterlockedDecrement.KERNEL32(?), ref: 04E7C4A4
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7C4B5
InterlockedExchange.KERNEL32(?,00000000), ref: 04E7C550
InterlockedDecrement.KERNEL32(?), ref: 04E7C561
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7C572

Part of subcall function 04E78350: InterlockedExchange.KERNEL32(?,00000000), ref: 04E783C9
Part of subcall function 04E78350: InterlockedDecrement.KERNEL32(?), ref: 04E783DA
Part of subcall function 04E78350: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04E87909,04F51C80,00000000), ref: 04E783EB

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$DecrementReleaseSemaphore$CompareCurrentThread
String ID:
API String ID: 1308783253-0
Opcode ID: 64692809e36cab716729e40f28c072d514231ba759aae9a21006367633e82b56
Instruction ID: b6461dea7b72852f0a6c895f30243bfcc4b6a63695d9514759e7d29394232f32
Opcode Fuzzy Hash: 64692809e36cab716729e40f28c072d514231ba759aae9a21006367633e82b56
Instruction Fuzzy Hash: 4641D4B1900702AFC720DF69E884866F7F8FB44329B148A2EE95597640D731FC85CBE1

Function 04E7C590 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8AC0: GetCurrentThreadId.KERNEL32 ref: 04DC8ACB
Part of subcall function 04DC8AC0: InterlockedCompareExchange.KERNEL32(02D20E84,00000000), ref: 04DC8AE6

InterlockedExchange.KERNEL32(04F5EDE8,00000000), ref: 04E7C5D3
InterlockedDecrement.KERNEL32(04F5EDEC), ref: 04E7C5E4
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04E87909,04F51C80,00000000), ref: 04E7C5F5
InterlockedExchange.KERNEL32(?,00000000), ref: 04E7C691
InterlockedDecrement.KERNEL32(?), ref: 04E7C6A2
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04E87909,04F51C80,00000000), ref: 04E7C6B3

Part of subcall function 04E78350: InterlockedExchange.KERNEL32(?,00000000), ref: 04E783C9
Part of subcall function 04E78350: InterlockedDecrement.KERNEL32(?), ref: 04E783DA
Part of subcall function 04E78350: ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,?,04E87909,04F51C80,00000000), ref: 04E783EB

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$DecrementReleaseSemaphore$CompareCurrentThread
String ID:
API String ID: 1308783253-0
Opcode ID: 64a3b13eef49fca873be543a6360e7cec73f466fcfcd8c24d8bc5a174be9d78c
Instruction ID: 9850a25a292078f4adbfbb3df39af259f6fc3909790f0d01a16190aee4fa7e32
Opcode Fuzzy Hash: 64a3b13eef49fca873be543a6360e7cec73f466fcfcd8c24d8bc5a174be9d78c
Instruction Fuzzy Hash: 9441F4B1500702AFC720DFA9E8C4866F7B8FB44728B249E2EE95693240D731F955CBE1

Function 04DFC620 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8AC0: GetCurrentThreadId.KERNEL32 ref: 04DC8ACB
Part of subcall function 04DC8AC0: InterlockedCompareExchange.KERNEL32(02D20E84,00000000), ref: 04DC8AE6

InterlockedExchange.KERNEL32(?,00000000), ref: 04DFC66B
InterlockedDecrement.KERNEL32(?), ref: 04DFC67C
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DFC68E
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04DFC6B9
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04DFC6D5
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04DFC6F1

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Compare$InterlockedStringUnicode$Exchange$CurrentDecrementReleaseSemaphoreThread
String ID:
API String ID: 3862866163-0
Opcode ID: 193b6078883642e9f32c099f21f8569a5cd4aa80b3c88bd33458bad55ad29df8
Instruction ID: e1f31328acf012ed79d91d79af4b829b9de8b1b3b837f55a0f2ef73df0f4da5e
Opcode Fuzzy Hash: 193b6078883642e9f32c099f21f8569a5cd4aa80b3c88bd33458bad55ad29df8
Instruction Fuzzy Hash: 2831E3353043059BDB10EF25DC48BAAB3A9FF80726F01451DE95997280DB74F909CBA5

Function 04E84500 Relevance: 9.1, APIs: 6, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 04DC8AC0: GetCurrentThreadId.KERNEL32 ref: 04DC8ACB
Part of subcall function 04DC8AC0: InterlockedCompareExchange.KERNEL32(02D20E84,00000000), ref: 04DC8AE6

Part of subcall function 04E7BDA0: InterlockedExchange.KERNEL32(00000008,00000000), ref: 04E7BDE8
Part of subcall function 04E7BDA0: InterlockedDecrement.KERNEL32(0000000C), ref: 04E7BDF9
Part of subcall function 04E7BDA0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7BE0B

InterlockedExchange.KERNEL32(?,00000000), ref: 04E8455B
InterlockedDecrement.KERNEL32(?), ref: 04E8456C
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E8457E
InterlockedExchange.KERNEL32(?,00000000), ref: 04E845AF
InterlockedDecrement.KERNEL32(?), ref: 04E845C0
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E845D2

Part of subcall function 04E7DFD0: InterlockedExchange.KERNEL32(?,00000000), ref: 04E7E00D
Part of subcall function 04E7DFD0: InterlockedDecrement.KERNEL32(?), ref: 04E7E01E
Part of subcall function 04E7DFD0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E7E030

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$DecrementReleaseSemaphore$CompareCurrentThread
String ID:
API String ID: 1308783253-0
Opcode ID: 1463d52dfb3c86542861eab080d199cd978994b4f78c5d6014e2edeb79842333
Instruction ID: f5d87dfee148f55ed17d99a96d0860d334c43979555a28ad7c928ec467897e90
Opcode Fuzzy Hash: 1463d52dfb3c86542861eab080d199cd978994b4f78c5d6014e2edeb79842333
Instruction Fuzzy Hash: EB218F31600301ABD724EF25E844F9BB7A9EF84729F008A1DF59A932C0DB74F904CBA1

Function 04E045E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 04E045EA
WaitForSingleObject.KERNEL32(?,000000FF), ref: 04E04604

Strings

BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::Stop, xrefs: 04E0462B
WaitForSingleObject() returned , xrefs: 04E04626
core, xrefs: 04E04630

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: EventObjectSingleWait
String ID: BoxedApp::FileSystem::Utils::Impl::CGlobalRealFileNotificationManager::Stop$WaitForSingleObject() returned $core
API String ID: 582559000-112852539
Opcode ID: 5ad4f6618da9a7b90688d0f6e8b970037704d751cea4c18ba75a08a5d06be18a
Instruction ID: 2ac633e7d453403682ee96f6503faf3fbbf1781273961eb072f7a739e5b2e091
Opcode Fuzzy Hash: 5ad4f6618da9a7b90688d0f6e8b970037704d751cea4c18ba75a08a5d06be18a
Instruction Fuzzy Hash: 5901443174022257DB18FB78FC56D6A33D55F84A18B045A79B51AD77D0FD28FC488681

Function 04E4C7A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 04E4C7A6
GetLastError.KERNEL32 ref: 04E4C7B4

Part of subcall function 04E50510: GetLocalTime.KERNEL32 ref: 04E50559
Part of subcall function 04E50510: GetCurrentProcessId.KERNEL32(04EB3000,?,04E9E704,?,04E9DFD8,?,04E9DFD8,75922E80,04EB3000,?,04EB3004,?,04EB3004,75922E80,bx:), ref: 04E50628
Part of subcall function 04E50510: GetCurrentThreadId.KERNEL32 ref: 04E50644

Part of subcall function 04E4F6B0: wsprintfA.USER32 ref: 04E4F6C8

Part of subcall function 04E4D390: DbgPrint.NTDLL ref: 04E4D3A9
Part of subcall function 04E4D390: WriteFile.KERNEL32(00000000,04F51C80,?,?,00000000,?,?,?,?,?,?,?,?,?,04E2C505,?), ref: 04E4D3D6

Strings

BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init, xrefs: 04E4C7DB
: TlsAlloc() failed, GetLastError() = , xrefs: 04E4C7D6
layer/sandbox, xrefs: 04E4C7E0

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$AllocErrorFileLastLocalPrintProcessThreadTimeWritewsprintf
String ID: : TlsAlloc() failed, GetLastError() = $BoxedApp::ApiLayer::CAutoForceWriteCopyMode::Init$layer/sandbox
API String ID: 1681842421-663972680
Opcode ID: c498d3ec722d2ea06ef768976892ec8f1342d291cafcf2f38b4959890067a282
Instruction ID: a9ee8f8cca5dbea4f60755ccc4f998de2861de593c2c83ca2d780dc157c324d2
Opcode Fuzzy Hash: c498d3ec722d2ea06ef768976892ec8f1342d291cafcf2f38b4959890067a282
Instruction Fuzzy Hash: D801D635B402115BE724FB38EC14A7A37919FC4629F511B78E805DB2D0FE68FC0486C1

Function 04E74060 Relevance: 7.7, APIs: 5, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E74070
InterlockedCompareExchange.KERNEL32(04F51C9C,00000000,00000000), ref: 04E7408E

Part of subcall function 04DFA150: InterlockedExchange.KERNEL32(?,00000000), ref: 04DFA16C
Part of subcall function 04DFA150: InterlockedDecrement.KERNEL32(?), ref: 04DFA17D
Part of subcall function 04DFA150: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000,?,?,?,00000000,00000000,?,00000000,00000030), ref: 04DFA18B

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$CompareCurrentDecrementReleaseSemaphoreThread
String ID:
API String ID: 3542523172-0
Opcode ID: 1c9b0661ff804828a7aa98f456125be6daf274bb01dda29ea610d0d0175e2c9b
Instruction ID: 9d5336446f39879b87904ca426b943f0575b5db742637594f310ec4c8d87b6e7
Opcode Fuzzy Hash: 1c9b0661ff804828a7aa98f456125be6daf274bb01dda29ea610d0d0175e2c9b
Instruction Fuzzy Hash: 4C51B3337002558FCA10EE58FC40896F3A4FBA0276B05093BEA5993780DB36BD1EC7A5

Function 04DF8560 Relevance: 7.7, APIs: 5, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04DF856B
InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04DF858A
InterlockedExchange.KERNEL32(?,00000000), ref: 04DF86E6
InterlockedDecrement.KERNEL32(?), ref: 04DF86F7
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04DF8705

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$CompareCurrentDecrementReleaseSemaphoreThread
String ID:
API String ID: 3542523172-0
Opcode ID: 437de52e085ea26cd88b2ed55887b3af5fbfcc5e0cccb8f6753687f3b12b3b89
Instruction ID: fad6972120e0074b3d6dfdbf6f088bd5946f3ee45ef76e8d9545929afb6923f7
Opcode Fuzzy Hash: 437de52e085ea26cd88b2ed55887b3af5fbfcc5e0cccb8f6753687f3b12b3b89
Instruction Fuzzy Hash: D35157B2200740AFD720EF65DC84A6BB7E9BF88704F05891DF69687290DB70F905DB62

Function 04E6A420 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 04E30AB0: GetLastError.KERNEL32(04F51C80,04E66E1D,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AB3

TlsGetValue.KERNEL32(00000014), ref: 04E6A433

Part of subcall function 04E30AE0: GetLastError.KERNEL32(00000000,04E66E83,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AE3
Part of subcall function 04E30AE0: SetLastError.KERNEL32(00000000,?,04F51C80,04E8E702,?,?,?,?,?,?,?), ref: 04E30AEE

Strings

), xrefs: 04E6A49D
NtExtendSection( SectionHandle = , xrefs: 04E6A4BE
, SectionSize = , xrefs: 04E6A4AE
core, xrefs: 04E6A4C3

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLast$Value
String ID: )$, SectionSize = $NtExtendSection( SectionHandle = $core
API String ID: 1883355122-3021227702
Opcode ID: 2eebc3ffee35ccb7432838aa63cc4b8a65942a7c1f00bca026b50980f055837f
Instruction ID: afd133e81eab993a577e5472749098f6c48d330e404c4e39d986e24afd683fa4
Opcode Fuzzy Hash: 2eebc3ffee35ccb7432838aa63cc4b8a65942a7c1f00bca026b50980f055837f
Instruction Fuzzy Hash: B8316275700200ABE704FB64DC94E6BB3E5AFD4648F04592CF88697290EB34FD05CB92

Function 04E947B0 Relevance: 7.6, APIs: 5, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04E947BA
InterlockedCompareExchange.KERNEL32(?,00000000), ref: 04E947D6
InterlockedExchange.KERNEL32(?,00000000), ref: 04E94819
InterlockedDecrement.KERNEL32(?), ref: 04E9482A
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 04E94838

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Interlocked$Exchange$CompareCurrentDecrementReleaseSemaphoreThread
String ID:
API String ID: 3542523172-0
Opcode ID: 14d452a79f411f0a127f7eaa52bd31811b9a9d0e61620aeeadf4b6706280f6e3
Instruction ID: ccca365f429b6f05a50e566f4b1a15374f11b8e5203f1f1abd115fa59daeb314
Opcode Fuzzy Hash: 14d452a79f411f0a127f7eaa52bd31811b9a9d0e61620aeeadf4b6706280f6e3
Instruction Fuzzy Hash: 03115C75208344ABDB348F25E848FA7B7E9AB41719F004A1DF862975C1DB74BD0AC660

Function 04E5A5A0 Relevance: 7.5, APIs: 5, Instructions: 49fileCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,00000020,00000000,04E611E9), ref: 04E5A5A9
UnlockFileEx.KERNEL32(?,00000000,00000001,00000000,00000044), ref: 04E5A5CA
GetLastError.KERNEL32 ref: 04E5A5D0
UnlockFileEx.KERNEL32(?,00000000,00000001,00000000,00000030), ref: 04E5A5F6
TlsSetValue.KERNEL32(?,-00000001), ref: 04E5A601

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: FileUnlockValue$ErrorLast
String ID:
API String ID: 603565765-0
Opcode ID: 374cb94c8005b9abde92df14e498bc65ede482fe039454486679184192d2c310
Instruction ID: c0707eb84949565e317e832ffb06d7646939aec02ce5f330578c59d279117817
Opcode Fuzzy Hash: 374cb94c8005b9abde92df14e498bc65ede482fe039454486679184192d2c310
Instruction Fuzzy Hash: C1016DB22103116BE7309A79EC85F6733ADEB88715F140A2AB641CA5C4DAA5FC418764

Function 04E9A090 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 04E9A0CE

Part of subcall function 04E93F10: RtlZeroMemory.NTDLL(00000000,00000008), ref: 04E93F1A

GetEnvironmentVariableW.KERNEL32(PATH,?,?,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,04E7D18D), ref: 04E9A103
GetFileAttributesW.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?), ref: 04E9A1B4

Part of subcall function 04E94070: HeapFree.KERNEL32(02D20000,00000001,?,04EC8948,04EC8944,?,?,?,?,?,?,?,04E36417,00000001,?), ref: 04E94098

Strings

PATH, xrefs: 04E9A0BD, 04E9A0FE

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: EnvironmentVariable$AttributesFileFreeHeapMemoryZero
String ID: PATH
API String ID: 1331966000-1036084923
Opcode ID: d7fadd1f47e14182309d534a303512349960b952d5888c60966e474d106db698
Instruction ID: c513c0ea48d30e326d14397c398a164fe6d7ad3918bb8ac63d75b331a201f44d
Opcode Fuzzy Hash: d7fadd1f47e14182309d534a303512349960b952d5888c60966e474d106db698
Instruction Fuzzy Hash: 4E5192B2A083446BDB14EF65EC8195FB7E4AF84708F041A2DF54597281DA31FE498BA3

Function 04E36050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 04E36083
wsprintfW.USER32 ref: 04E3609F

Strings

%s_%.8x, xrefs: 04E36099
%s_%.8x_%.8x, xrefs: 04E3607D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: wsprintf
String ID: %s_%.8x$%s_%.8x_%.8x
API String ID: 2111968516-1645394231
Opcode ID: 0405b5d426f4036f2c3308e5b2b6115633cdb98857cd8d7709fe3ccd18a40993
Instruction ID: c0987f46b1611264a9edd13067939602d4c3e098a4359fddb0d19e5bd3b46463
Opcode Fuzzy Hash: 0405b5d426f4036f2c3308e5b2b6115633cdb98857cd8d7709fe3ccd18a40993
Instruction Fuzzy Hash: CFF082B55003007BE224EB54DCC5FBB77A8EF88704F10490DB99457241E530F8158AE1

Function 04E2A790 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 04E302E0: RtlInitUnicodeString.NTDLL(?,00000000), ref: 04E302E9

RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04E2A82C
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04E2A850
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04E2A8A9
RtlCompareUnicodeString.NTDLL(00000000,00000000,00000001), ref: 04E2A900

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: StringUnicode$Compare$Init
String ID:
API String ID: 3700283247-0
Opcode ID: d41b397db91e93055c209efbf6bad70c12dccf0f53b478854821b8bfd197dde1
Instruction ID: 7366f0a5fdc1060cf6c50321a15b785473f3f00fe98e93db5c5372c3320f6425
Opcode Fuzzy Hash: d41b397db91e93055c209efbf6bad70c12dccf0f53b478854821b8bfd197dde1
Instruction Fuzzy Hash: 845189762003119FD304DF19C884EAAB7A8FF88729F054A6DF8469B295DB30F945CBE1

Function 04DC8030 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

RtlDosPathNameToNtPathName_U.NTDLL(?,00000000,00000000,00000000), ref: 04DC8059
SetLastError.KERNEL32(00000003), ref: 04DC80B1
SetLastError.KERNEL32(00000032), ref: 04DC80E3

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: ErrorLastPath$NameName_
String ID:
API String ID: 2460001642-0
Opcode ID: 013368798e6a89929c55b1d929e7401f4bfbf92fd407d65f5a73509a02cc0cf4
Instruction ID: e7cff861f5dbf623cea6d8a7e8f370119471872abe94748face6ae810e765b20
Opcode Fuzzy Hash: 013368798e6a89929c55b1d929e7401f4bfbf92fd407d65f5a73509a02cc0cf4
Instruction Fuzzy Hash: 965117352043029FD315EB64C894EABB7E9BFC8745F10491DF586872A4EB30F945CBA2

Function 09A1A150 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 09A1A1CE
GetCurrentThread.KERNEL32 ref: 09A1A20B
GetCurrentProcess.KERNEL32 ref: 09A1A248
GetCurrentThreadId.KERNEL32 ref: 09A1A2A1

Memory Dump Source

Source File: 00000009.00000002.2778951509.0000000009A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 09A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9a10000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5d90ce8b9c07645cd3abceba6832e2e424617ac955d9755aebf1a9da1ac0899e
Instruction ID: b83866166752e91b16a9ffee3c1997a55bbb3ef789f604fb5940fe39db40d827
Opcode Fuzzy Hash: 5d90ce8b9c07645cd3abceba6832e2e424617ac955d9755aebf1a9da1ac0899e
Instruction Fuzzy Hash: 845178B1901349CFDB14CFA9DA48B9EBBF1EF88314F248459E409A7360D735A944CF65

Function 04E8E5D0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04E8E5D9
InterlockedIncrement.KERNEL32(04EC8954), ref: 04E8E5F8
InterlockedCompareExchange.KERNEL32(00000000,?,00000000), ref: 04E8E605
GetTickCount.KERNEL32 ref: 04E8E61D

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CountInterlockedTick$CompareExchangeIncrement
String ID:
API String ID: 2541844095-0
Opcode ID: a36733f8b765f250d1d948b1b52a3398ffcea9422acbd0017c7db41c13abdc2e
Instruction ID: aa876c7012e92db761b5199b470b43be8a748e08f8d0bca773e04a520375f477
Opcode Fuzzy Hash: a36733f8b765f250d1d948b1b52a3398ffcea9422acbd0017c7db41c13abdc2e
Instruction Fuzzy Hash: DF11E3326443109BDE24AF39E904AAB779AEB81265F04591FE55AC31C0FB25F8059A60

Function 04E08780 Relevance: 5.2, APIs: 4, Instructions: 157COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 04E087FD
CloseHandle.KERNEL32(?), ref: 04E088E3
CloseHandle.KERNEL32(00000000,?,?,FFFFFFFF), ref: 04E08915
CloseHandle.KERNEL32(?), ref: 04E08930

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c7b5e9002ea6d9c8fe7ecf4bcf6ec96410a1d9c8eff4facb36cebc75cd6d8eec
Instruction ID: 5b1c888a1e8b6d5a679571f8c6faf7d7d0a3eb96f32634f4a2a20d341b5dcec2
Opcode Fuzzy Hash: c7b5e9002ea6d9c8fe7ecf4bcf6ec96410a1d9c8eff4facb36cebc75cd6d8eec
Instruction Fuzzy Hash: CE51C2717042009BE720EBA4CC94FABB3D8AF84768F544919F969D71D0EB70F944CBA2

Function 04E52090 Relevance: 5.1, APIs: 4, Instructions: 141stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?), ref: 04E520BF
lstrlenW.KERNEL32(?,?), ref: 04E520F4
lstrlenW.KERNEL32(?), ref: 04E52133
lstrlenW.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 04E52163

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 323bce7a8797d79b268e8d4fe7f1aec5eb93bb1053c5e4db65e0d086bf0cf0d4
Instruction ID: ab8f3f4f946ff4e19b28bc21937c3b3c83691525e11bce3971a789ac97f91330
Opcode Fuzzy Hash: 323bce7a8797d79b268e8d4fe7f1aec5eb93bb1053c5e4db65e0d086bf0cf0d4
Instruction Fuzzy Hash: 84416E712042406FE724EB69CD40F7BB3E9AFC8654F009A5CFA5AC7250EB70F9018B66

Function 04E8E440 Relevance: 5.1, APIs: 4, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0097E7E8), ref: 04E8E464
HeapFree.KERNEL32(00000000), ref: 04E8E467
GetProcessHeap.KERNEL32(00000000,?), ref: 04E8E493
HeapAlloc.KERNEL32(00000000), ref: 04E8E496

Memory Dump Source

Source File: 00000009.00000002.2761441462.0000000004DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: true

Associated: 00000009.00000002.2761441462.0000000004EC4000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2761441462.0000000004ECA000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4dc0000_LisectAVT_2403002B_286_Update.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 90675c6d3f5bc08d92284f0e67e64c97ecae745f54f4ab18e6df41753737d1a1
Instruction ID: d7fb6001559de17d4cbb04396873dca762e99a80601139a4981f91a9af45a561
Opcode Fuzzy Hash: 90675c6d3f5bc08d92284f0e67e64c97ecae745f54f4ab18e6df41753737d1a1
Instruction Fuzzy Hash: 3B11C2726011109FDB64BF6ADC45F677368FF9470AF08842DE40DCB288D678A8818BA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002B_286.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_286.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002B_286_Update.exe.log

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\5LOESKIH\war3tools.suyx[1].xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\f[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\f[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\bmltYV8yMjI3ODcyNTc0NTBfMTcxNzU3NjMyMTQzNV9iM2Q4ZmJjZC02ZjNkLTRiM2YtYTM1NS1iNjIyODI3MzJiOGI=[1].cache

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\header[1].htm

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.0.cs

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.cmdline

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.dll

C:\Users\user\AppData\Local\Temp\1kjwnqt4\1kjwnqt4.out

C:\Users\user\AppData\Local\Temp\1kjwnqt4\CSCF68404DF18AE46178AD88EB7B711C3F0.TMP

C:\Users\user\AppData\Local\Temp\RES3017.tmp

C:\Users\user\AppData\Local\Temp\RES6262.tmp

Windows Analysis Report
LisectAVT_2403002B_286.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre