Edit tour

Windows Analysis Report
LisectAVT_2403002A_2.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_2.exe
Analysis ID:	1482428
MD5:	e099ad7e57b0011262cc822808972e10
SHA1:	f2d3a518ebe54091351ced1d068db43f4dc09056
SHA256:	449b2930259030577c8ac1061e4fd12e815b06597f8a55becf318efd44eac323
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_2.exe (PID: 6488 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe" MD5: E099AD7E57B0011262CC822808972E10)

powershell.exe (PID: 1416 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 764 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2196 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 4884 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 2528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7144 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

qHqJcuLw.exe (PID: 1320 cmdline: C:\Users\user\AppData\Roaming\qHqJcuLw.exe MD5: E099AD7E57B0011262CC822808972E10)

schtasks.exe (PID: 6948 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 7056 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "sg2plcpnl0128.prod.sin2.secureserver.net", "Username": "accounts@equityhyundai.com", "Password": "oc27-JcbRAO~"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_2.exe PID: 6488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_2.exe PID: 6488	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7144	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: qHqJcuLw.exe PID: 1320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: qHqJcuLw.exe PID: 1320	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: qHqJcuLw.exe PID: 1320	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7056	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7056	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.qHqJcuLw.exe.461a338.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.qHqJcuLw.exe.461a338.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.qHqJcuLw.exe.461a338.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3185b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x318cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31957:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x319e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a53:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ac5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b5b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31beb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3185b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x318cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31957:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x319e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a53:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ac5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b5b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31beb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3185b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x318cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31957:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x319e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a53:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ac5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b5b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31beb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3365b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33757:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33853:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3395b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.qHqJcuLw.exe.45df718.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.qHqJcuLw.exe.45df718.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.qHqJcuLw.exe.45df718.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3185b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x318cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31957:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x319e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31a53:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31ac5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31b5b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31beb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.qHqJcuLw.exe.45df718.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.qHqJcuLw.exe.45df718.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.qHqJcuLw.exe.45df718.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3365b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e27b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e2ed:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33757:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e377:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e409:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33853:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e473:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e4e5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3395b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e57b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e60b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.qHqJcuLw.exe.461a338.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.qHqJcuLw.exe.461a338.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.qHqJcuLw.exe.461a338.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3365b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33757:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33853:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3395b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3365b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e27b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e2ed:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33757:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e377:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e409:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33853:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e473:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e4e5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3395b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e57b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e60b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3365b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x336cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33757:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x337e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33853:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x338c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3395b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x339eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe, ParentProcessId: 6488, ParentProcessName: LisectAVT_2403002A_2.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ProcessId: 1416, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\qHqJcuLw.exe, ParentImage: C:\Users\user\AppData\Roaming\qHqJcuLw.exe, ParentProcessId: 1320, ParentProcessName: qHqJcuLw.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp", ProcessId: 6948, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 182.50.135.77, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7144, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe, ParentProcessId: 6488, ParentProcessName: LisectAVT_2403002A_2.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", ProcessId: 4884, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe, ParentProcessId: 6488, ParentProcessName: LisectAVT_2403002A_2.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ProcessId: 1416, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe, ParentProcessId: 6488, ParentProcessName: LisectAVT_2403002A_2.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp", ProcessId: 4884, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T22:53:05.892965+0200
SID:	2022930
Source Port:	443
Destination Port:	49721
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T22:53:43.946681+0200
SID:	2022930
Source Port:	443
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_2.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.google.com

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Avira: detection malicious, Label: TR/AD.GenSteal.gwmnl

Found malware configuration

Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "sg2plcpnl0128.prod.sin2.secureserver.net", "Username": "accounts@equityhyundai.com", "Password": "oc27-JcbRAO~"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_2.exe

Joe Sandbox ML: detected

Source: LisectAVT_2403002A_2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49718 version: TLS 1.2

Source: LisectAVT_2403002A_2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: bSgh.pdbSHA256 source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr
Source:	Binary string: bSgh.pdb source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 4x nop then jmp 07517D76h		1_2_0751837C
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 4x nop then jmp 0769705Eh		12_2_07697664

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 182.50.135.77:587

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 182.50.135.77 182.50.135.77

Source: Joe Sandbox View

ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49715 -> 182.50.135.77:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: sg2plcpnl0128.prod.sin2.secureserver.net

Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2176593205.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2222420893.0000000003310000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sg2plcpnl0128.prod.sin2.secureserver.net
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2176593205.0000000003041000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2222420893.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr	String found in binary or memory: http://www.google.com)Uygun
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr	String found in binary or memory: https://www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49718 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, n00.cs	.Net Code: Ajjb
Source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, n00.cs	.Net Code: Ajjb

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.qHqJcuLw.exe.461a338.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.qHqJcuLw.exe.45df718.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.qHqJcuLw.exe.45df718.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.qHqJcuLw.exe.461a338.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_015CD5FC	1_2_015CD5FC
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_07511CF1	1_2_07511CF1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_075142E8	1_2_075142E8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_07512138	1_2_07512138
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_07513938	1_2_07513938
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_07513928	1_2_07513928
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_0751A858	1_2_0751A858
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Code function: 1_2_075118C8	1_2_075118C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00EDE3C1	10_2_00EDE3C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00ED4AB8	10_2_00ED4AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00EDAA40	10_2_00EDAA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00ED3EA0	10_2_00ED3EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00ED41E8	10_2_00ED41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C5640	10_2_062C5640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C6690	10_2_062C6690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062CC228	10_2_062CC228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062CB2C8	10_2_062CB2C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C30F8	10_2_062C30F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C7E20	10_2_062C7E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C7740	10_2_062C7740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C2420	10_2_062C2420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062CE438	10_2_062CE438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C0040	10_2_062C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C5D83	10_2_062C5D83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_062C0039	10_2_062C0039
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_0160D5FC	12_2_0160D5FC
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_07691CF1	12_2_07691CF1
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_07699A78	12_2_07699A78
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_076942E8	12_2_076942E8
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_07693928	12_2_07693928
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_07692138	12_2_07692138
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_07693938	12_2_07693938
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_0769187D	12_2_0769187D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DDE7C1	15_2_00DDE7C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DD4AB8	15_2_00DD4AB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DDAA50	15_2_00DDAA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DD3EA0	15_2_00DD3EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DD41E8	15_2_00DD41E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0639A1B4	15_2_0639A1B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0639BA00	15_2_0639BA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A5640	15_2_063A5640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A6690	15_2_063A6690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063AC228	15_2_063AC228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063AB2C8	15_2_063AB2C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A30F8	15_2_063A30F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A7E20	15_2_063A7E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063ACFD8	15_2_063ACFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A7740	15_2_063A7740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063AE438	15_2_063AE438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A2420	15_2_063A2420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A8469	15_2_063A8469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A0040	15_2_063A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A5D83	15_2_063A5D83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_063A001E	15_2_063A001E

Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee3f96683-b7f1-43d4-a3c4-2560ec391fa8.exe4 vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2182321862.00000000072C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2175192068.000000000130E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2183026021.00000000080A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe, 00000001.00000002.2176593205.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee3f96683-b7f1-43d4-a3c4-2560ec391fa8.exe4 vs LisectAVT_2403002A_2.exe
Source: LisectAVT_2403002A_2.exe	Binary or memory string: OriginalFilenamebSgh.exeF vs LisectAVT_2403002A_2.exe

Source: LisectAVT_2403002A_2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.qHqJcuLw.exe.461a338.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.qHqJcuLw.exe.45df718.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.qHqJcuLw.exe.45df718.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.qHqJcuLw.exe.461a338.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: LisectAVT_2403002A_2.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: qHqJcuLw.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, Gtx0Eoxc3Jl7r2dDpt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: _0020.SetAccessControl
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: _0020.AddAccessRule
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: _0020.SetAccessControl
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, csyq77VieeGgrWwj6C.cs	Security API names: _0020.AddAccessRule
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, Gtx0Eoxc3Jl7r2dDpt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 1.2.LisectAVT_2403002A_2.exe.308b308.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 1.2.LisectAVT_2403002A_2.exe.58c0000.7.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 1.2.LisectAVT_2403002A_2.exe.3093320.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@2/2

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File created: C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6416:120:WilError_03
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Mutant created: \Sessions\1\BaseNamedObjects\fpCdGkIXddE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1336:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File created: C:\Users\user\AppData\Local\Temp\tmpCF64.tmp

Jump to behavior

Source: LisectAVT_2403002A_2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\qHqJcuLw.exe C:\Users\user\AppData\Roaming\qHqJcuLw.exe
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: LisectAVT_2403002A_2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002A_2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: LisectAVT_2403002A_2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: bSgh.pdbSHA256 source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr
Source:	Binary string: bSgh.pdb source: LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: LisectAVT_2403002A_2.exe, BowserOdevi.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: qHqJcuLw.exe.1.dr, BowserOdevi.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, csyq77VieeGgrWwj6C.cs	.Net Code: oeiUEOdQOe System.Reflection.Assembly.Load(byte[])
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, csyq77VieeGgrWwj6C.cs	.Net Code: oeiUEOdQOe System.Reflection.Assembly.Load(byte[])

Source: LisectAVT_2403002A_2.exe

Static PE information: 0xC6950FA3 [Mon Jul 29 20:27:15 2075 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00ED0CCB push edi; retf	10_2_00ED0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 10_2_00ED0C45 push ebx; retf	10_2_00ED0C52
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Code function: 12_2_056789E0 push eax; mov dword ptr [esp], ecx	12_2_056789E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DD0CCB push edi; retf	15_2_00DD0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_00DD0C45 push ebx; retf	15_2_00DD0C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0639FB10 push es; iretd	15_2_0639FB1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0639FB44 push es; iretd	15_2_0639FB48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 15_2_0639FBCD push es; iretd	15_2_0639FBDC

Source: LisectAVT_2403002A_2.exe	Static PE information: section name: .text entropy: 7.894347092736149
Source: qHqJcuLw.exe.1.dr	Static PE information: section name: .text entropy: 7.894347092736149

Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 1.2.LisectAVT_2403002A_2.exe.58b0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, PIh5iim8RpSHSH5ngN.cs	High entropy of concatenated method names: 'BPblCF32Ix', 'U1qldgAeu1', 'W44lgt7qPm', 'IiflQebvbS', 'GlflVIj92F', 'a4QgtZcIO9', 'soPgKDIVVu', 'Cu7gR9RaN8', 'toTgiyBCIG', 'Nufgfwxfxy'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, fmV0k6hepwABJ9MUVW4.cs	High entropy of concatenated method names: 'ehDX3NT5Kd', 'iUsXFT1Al3', 'x8oXE4HOm5', 'D7iX82ASqX', 's0nXGnnVyY', 'rvYXMyeGZL', 'NL4Xp00ZNt', 'QwAXxo33lu', 'LriXyKPyeD', 'Pt1X9Z6H3a'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, wkfaEpsjMnC3hJlq3A.cs	High entropy of concatenated method names: 'fAdE33fgU', 'uKN8Ovw6L', 'ar1MrKM7m', 'FjBpmYIJI', 'bIgy7smIc', 'DnC9FvCGs', 'E33Jngf87Jbc84hwpi', 'BpjiTu4w2l2c2pWiTC', 'wWoH0vW6s', 'Q5FrdXQZq'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, Gtx0Eoxc3Jl7r2dDpt.cs	High entropy of concatenated method names: 'BludOGrhhF', 'dMKdIltYqZ', 'EJOdNRWxAA', 'Q09dY8WMQm', 'EhVdtrZ2Cg', 'JljdKWm3iV', 'imjdR21tnE', 'pmCdiw3Jsy', 'H2adfCrS7Q', 'ly8dTFJw0W'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, GZvA1jhhKokUkk4kn1Z.cs	High entropy of concatenated method names: 'ToString', 'v0wrZp9GRm', 'zVBrUibASS', 'QxxrCjCm6R', 'F4sroa3GPq', 'FM0rdvaeJL', 'QwgrcGRMLD', 'KXSrgaHutn', 'OQvHbMdbjkJFe63VA4Y', 'oLmZCld3PfTsi9VLp1x'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, bhEvQparuJZ8BNPWlg.cs	High entropy of concatenated method names: 'kuuQ3wcWuY', 'yXpQF7SMLS', 'BiCQE9fHIc', 'fEyQ8f6cig', 'outQGYmBoe', 'RjnQMt7FNg', 'XvIQpcOBKp', 'NqwQxUXdC5', 'rhZQyoAwAi', 'wmwQ996LhK'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, VvBHyt7OvMu57IvZyy.cs	High entropy of concatenated method names: 'T786xD0xWG', 'h5p6y9e9kp', 'OXX6mF5P3g', 'bMr6WuwVSo', 'J9M6JLFbd7', 'rVi6B6JkhK', 'wtj6wiZFlJ', 'BYR6LmP1XW', 'PmC6AMRtsn', 'hu46ky3maf'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, LUdbk4dM5G1Wl6aYnw.cs	High entropy of concatenated method names: 'Dispose', 'fq4hfT8hcQ', 'sS7sW40wp4', 'Duj55VPftW', 'XoyhTYAIft', 'oGKhzSL7L7', 'ProcessDialogKey', 'SpSseXdaoY', 'aevshP8uu8', 'Y07ssVwjYB'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, kwjYBOTK5uliDdEeSV.cs	High entropy of concatenated method names: 'VQfXhk7gQ7', 'A85XZA32kW', 'ahwXU2t5lY', 'h75Xo4crNc', 'f6WXdxpxnL', 'CoQXgZGmoQ', 'NOoXlJ4DJV', 'p71HRl9oxm', 'DkwHiaoGkF', 'lUMHfkmTJ0'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, GoZLMXhZhOoQ9V3t55Z.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GfxrOsBCiZ', 'x6drISMHbU', 'Pt5rN39u32', 'pAlrYtZUX0', 's3ertbh2A8', 'fHnrKH64Iv', 'AYYrR6MZ32'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, krG3qNwmBc1T95d6a5.cs	High entropy of concatenated method names: 'RP3Qo5rgdT', 'a8CQcqUNIY', 'uOPQlx0tDV', 'phNlTfPmpV', 'F6AlzIj93I', 'mcdQeBV1lI', 'W1ZQhtPBC0', 'xeVQsFfRrI', 'cpkQZF3Buw', 'pXnQUy8DOj'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, FNmeIozGOrWwFX9H2g.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kp9X6LrebR', 'R0RX0wCQRu', 'jJTXvp0J8B', 'XdQXuOvvTK', 'tQ2XH9YbtT', 'aP1XXv65XB', 'NTQXrZSJHN'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, csyq77VieeGgrWwj6C.cs	High entropy of concatenated method names: 'bYkZCYXdsx', 'L9bZoDC8k8', 'VKAZdgBnLk', 'slCZcXVi21', 'mufZgdTO64', 'hD6ZlwEDvB', 'kKlZQH0WkR', 'xlyZVBkVmS', 'D4uZnYPJcL', 'nVmZD4prSS'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, HUT48FUp7cQjRlwnRp.cs	High entropy of concatenated method names: 'avmhQtx0Eo', 'g3JhVl7r2d', 'Xt7hDZrIDN', 'j4Rh5sJKEs', 'BNmh0HuqIh', 'miihv8RpSH', 'WAuruj0Y3JFYwBdTbW', 'sL01iYwiv0mPNlS0u9', 'CpKhhiENsd', 'TOkhZlOQQD'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, jWFgVNKdk6m9BiqcsQ.cs	High entropy of concatenated method names: 'iaquiUXNbO', 'JxZuTUIe2c', 'UiuHeX6QdX', 'cyUHh5lnCy', 'jhqukgZhKx', 'ooKuqbAxWA', 's3gu7xUR65', 'rkAuOJLhB0', 'e8EuIRlKJ6', 'TQUuNJM9bl'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, Ib3OsQcQqutoyeUHtr.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Vrwsf5whTY', 'hKosTjAFgr', 'Slgszm627x', 'nmGZeeo5V4', 'DNqZh0YxVr', 's3nZsJu8Hs', 'RrqZZyZ5ub', 'fekAYvW75HQQ5CoNqFW'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, JKEsd0945PwyTGNmHu.cs	High entropy of concatenated method names: 'shNgGD92Cw', 'On3gpxawpE', 'zrFc41KnNd', 'VN9cJRIHDe', 'YvQcBomfEj', 'XiFcjt7Vff', 'xt9cwEOoxS', 'XIScLy9SOJ', 'vVbcaHLt7W', 'pI6cA7cIiG'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, dhIThTOdtGw4jwHPam.cs	High entropy of concatenated method names: 'LJk0AGjfhA', 'TfV0qJc51T', 'WwW0OkgSW3', 'kmh0I4U0uU', 'DHq0Wes8km', 'uAB04htoBf', 'M8V0Jf9gmm', 'xY90B0nmFM', 'zs90jNsDoP', 'RnG0wwoXvT'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, tKo7Tfyt7ZrIDNQ4Rs.cs	High entropy of concatenated method names: 'P2Vc8GNGeT', 'smicMdhGQK', 'fZYcx547JH', 'Ff5cy4fgi0', 'lDic0GG5py', 'x8scvBdorO', 'XxycuAl2IW', 'akTcHkt1gr', 'nlNcXG3hOW', 'Kv6crwIqmR'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, wXdaoYfeevP8uu8T07.cs	High entropy of concatenated method names: 'DuIHmOAyvZ', 'UOnHWskoi8', 'SypH48krBV', 'TfCHJNHhGR', 'h1JHO6XCbe', 'umfHBvPpND', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.LisectAVT_2403002A_2.exe.80a0000.8.raw.unpack, fyYAIfit0GKSL7L7Ip.cs	High entropy of concatenated method names: 'FinHoKSrvZ', 'tHwHd2jjpZ', 'ofZHcHXwpE', 'og4HgfEmjC', 'WLYHlnJ6RY', 'j9qHQoHZJu', 'VS7HVwa3ve', 'U3bHnvrTs1', 'dI0HDxpUaB', 'xKlH5wJv0g'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, PIh5iim8RpSHSH5ngN.cs	High entropy of concatenated method names: 'BPblCF32Ix', 'U1qldgAeu1', 'W44lgt7qPm', 'IiflQebvbS', 'GlflVIj92F', 'a4QgtZcIO9', 'soPgKDIVVu', 'Cu7gR9RaN8', 'toTgiyBCIG', 'Nufgfwxfxy'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, fmV0k6hepwABJ9MUVW4.cs	High entropy of concatenated method names: 'ehDX3NT5Kd', 'iUsXFT1Al3', 'x8oXE4HOm5', 'D7iX82ASqX', 's0nXGnnVyY', 'rvYXMyeGZL', 'NL4Xp00ZNt', 'QwAXxo33lu', 'LriXyKPyeD', 'Pt1X9Z6H3a'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, wkfaEpsjMnC3hJlq3A.cs	High entropy of concatenated method names: 'fAdE33fgU', 'uKN8Ovw6L', 'ar1MrKM7m', 'FjBpmYIJI', 'bIgy7smIc', 'DnC9FvCGs', 'E33Jngf87Jbc84hwpi', 'BpjiTu4w2l2c2pWiTC', 'wWoH0vW6s', 'Q5FrdXQZq'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, Gtx0Eoxc3Jl7r2dDpt.cs	High entropy of concatenated method names: 'BludOGrhhF', 'dMKdIltYqZ', 'EJOdNRWxAA', 'Q09dY8WMQm', 'EhVdtrZ2Cg', 'JljdKWm3iV', 'imjdR21tnE', 'pmCdiw3Jsy', 'H2adfCrS7Q', 'ly8dTFJw0W'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, GZvA1jhhKokUkk4kn1Z.cs	High entropy of concatenated method names: 'ToString', 'v0wrZp9GRm', 'zVBrUibASS', 'QxxrCjCm6R', 'F4sroa3GPq', 'FM0rdvaeJL', 'QwgrcGRMLD', 'KXSrgaHutn', 'OQvHbMdbjkJFe63VA4Y', 'oLmZCld3PfTsi9VLp1x'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, bhEvQparuJZ8BNPWlg.cs	High entropy of concatenated method names: 'kuuQ3wcWuY', 'yXpQF7SMLS', 'BiCQE9fHIc', 'fEyQ8f6cig', 'outQGYmBoe', 'RjnQMt7FNg', 'XvIQpcOBKp', 'NqwQxUXdC5', 'rhZQyoAwAi', 'wmwQ996LhK'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, VvBHyt7OvMu57IvZyy.cs	High entropy of concatenated method names: 'T786xD0xWG', 'h5p6y9e9kp', 'OXX6mF5P3g', 'bMr6WuwVSo', 'J9M6JLFbd7', 'rVi6B6JkhK', 'wtj6wiZFlJ', 'BYR6LmP1XW', 'PmC6AMRtsn', 'hu46ky3maf'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, LUdbk4dM5G1Wl6aYnw.cs	High entropy of concatenated method names: 'Dispose', 'fq4hfT8hcQ', 'sS7sW40wp4', 'Duj55VPftW', 'XoyhTYAIft', 'oGKhzSL7L7', 'ProcessDialogKey', 'SpSseXdaoY', 'aevshP8uu8', 'Y07ssVwjYB'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, kwjYBOTK5uliDdEeSV.cs	High entropy of concatenated method names: 'VQfXhk7gQ7', 'A85XZA32kW', 'ahwXU2t5lY', 'h75Xo4crNc', 'f6WXdxpxnL', 'CoQXgZGmoQ', 'NOoXlJ4DJV', 'p71HRl9oxm', 'DkwHiaoGkF', 'lUMHfkmTJ0'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, GoZLMXhZhOoQ9V3t55Z.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'GfxrOsBCiZ', 'x6drISMHbU', 'Pt5rN39u32', 'pAlrYtZUX0', 's3ertbh2A8', 'fHnrKH64Iv', 'AYYrR6MZ32'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, krG3qNwmBc1T95d6a5.cs	High entropy of concatenated method names: 'RP3Qo5rgdT', 'a8CQcqUNIY', 'uOPQlx0tDV', 'phNlTfPmpV', 'F6AlzIj93I', 'mcdQeBV1lI', 'W1ZQhtPBC0', 'xeVQsFfRrI', 'cpkQZF3Buw', 'pXnQUy8DOj'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, FNmeIozGOrWwFX9H2g.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Kp9X6LrebR', 'R0RX0wCQRu', 'jJTXvp0J8B', 'XdQXuOvvTK', 'tQ2XH9YbtT', 'aP1XXv65XB', 'NTQXrZSJHN'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, csyq77VieeGgrWwj6C.cs	High entropy of concatenated method names: 'bYkZCYXdsx', 'L9bZoDC8k8', 'VKAZdgBnLk', 'slCZcXVi21', 'mufZgdTO64', 'hD6ZlwEDvB', 'kKlZQH0WkR', 'xlyZVBkVmS', 'D4uZnYPJcL', 'nVmZD4prSS'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, HUT48FUp7cQjRlwnRp.cs	High entropy of concatenated method names: 'avmhQtx0Eo', 'g3JhVl7r2d', 'Xt7hDZrIDN', 'j4Rh5sJKEs', 'BNmh0HuqIh', 'miihv8RpSH', 'WAuruj0Y3JFYwBdTbW', 'sL01iYwiv0mPNlS0u9', 'CpKhhiENsd', 'TOkhZlOQQD'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, jWFgVNKdk6m9BiqcsQ.cs	High entropy of concatenated method names: 'iaquiUXNbO', 'JxZuTUIe2c', 'UiuHeX6QdX', 'cyUHh5lnCy', 'jhqukgZhKx', 'ooKuqbAxWA', 's3gu7xUR65', 'rkAuOJLhB0', 'e8EuIRlKJ6', 'TQUuNJM9bl'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, Ib3OsQcQqutoyeUHtr.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Vrwsf5whTY', 'hKosTjAFgr', 'Slgszm627x', 'nmGZeeo5V4', 'DNqZh0YxVr', 's3nZsJu8Hs', 'RrqZZyZ5ub', 'fekAYvW75HQQ5CoNqFW'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, JKEsd0945PwyTGNmHu.cs	High entropy of concatenated method names: 'shNgGD92Cw', 'On3gpxawpE', 'zrFc41KnNd', 'VN9cJRIHDe', 'YvQcBomfEj', 'XiFcjt7Vff', 'xt9cwEOoxS', 'XIScLy9SOJ', 'vVbcaHLt7W', 'pI6cA7cIiG'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, dhIThTOdtGw4jwHPam.cs	High entropy of concatenated method names: 'LJk0AGjfhA', 'TfV0qJc51T', 'WwW0OkgSW3', 'kmh0I4U0uU', 'DHq0Wes8km', 'uAB04htoBf', 'M8V0Jf9gmm', 'xY90B0nmFM', 'zs90jNsDoP', 'RnG0wwoXvT'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, tKo7Tfyt7ZrIDNQ4Rs.cs	High entropy of concatenated method names: 'P2Vc8GNGeT', 'smicMdhGQK', 'fZYcx547JH', 'Ff5cy4fgi0', 'lDic0GG5py', 'x8scvBdorO', 'XxycuAl2IW', 'akTcHkt1gr', 'nlNcXG3hOW', 'Kv6crwIqmR'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, wXdaoYfeevP8uu8T07.cs	High entropy of concatenated method names: 'DuIHmOAyvZ', 'UOnHWskoi8', 'SypH48krBV', 'TfCHJNHhGR', 'h1JHO6XCbe', 'umfHBvPpND', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.LisectAVT_2403002A_2.exe.44263c0.3.raw.unpack, fyYAIfit0GKSL7L7Ip.cs	High entropy of concatenated method names: 'FinHoKSrvZ', 'tHwHd2jjpZ', 'ofZHcHXwpE', 'og4HgfEmjC', 'WLYHlnJ6RY', 'j9qHQoHZJu', 'VS7HVwa3ve', 'U3bHnvrTs1', 'dI0HDxpUaB', 'xKlH5wJv0g'

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

File created: C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: qHqJcuLw.exe PID: 1320, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 8120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 9120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: 93E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: A3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 15E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 7DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 8DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: 7DD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7766	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1173	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6137	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 808	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1604	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1383	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1034
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3131

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe TID: 1396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2248	Thread sleep count: 7766 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4904	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2248	Thread sleep count: 1173 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1492	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe TID: 4928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98935	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98496	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98277	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97731
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: RegSvcs.exe, 0000000A.00000002.2199598243.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3368267188.0000000005D2A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 972008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 9B0008	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Queries volume information: C:\Users\user\AppData\Roaming\qHqJcuLw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qHqJcuLw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\LisectAVT_2403002A_2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_2.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qHqJcuLw.exe PID: 1320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7056, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_2.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qHqJcuLw.exe PID: 1320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7056, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.45df718.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.qHqJcuLw.exe.461a338.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.437e780.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.LisectAVT_2403002A_2.exe.43b93a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_2.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: qHqJcuLw.exe PID: 1320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	1 Credentials in Registry	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_2.exe	100%	Avira	TR/AD.GenSteal.gwmnl
LisectAVT_2403002A_2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\qHqJcuLw.exe	100%	Avira	TR/AD.GenSteal.gwmnl
C:\Users\user\AppData\Roaming\qHqJcuLw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://www.google.com	100%	URL Reputation	malware
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.google.com)Uygun	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://sg2plcpnl0128.prod.sin2.secureserver.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sg2plcpnl0128.prod.sin2.secureserver.net	182.50.135.77	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://sg2plcpnl0128.prod.sin2.secureserver.net	RegSvcs.exe, 0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://www.google.com	LisectAVT_2403002A_2.exe, 00000001.00000002.2176593205.0000000003041000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2222420893.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://api.ipify.org	LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.google.com)Uygun	LisectAVT_2403002A_2.exe, qHqJcuLw.exe.1.dr	true	Avira URL Cloud: safe	unknown
https://account.dyn.com/	LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_2.exe, 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002A_2.exe, 00000001.00000002.2176593205.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2201120787.00000000029FB000.00000004.00000800.00020000.00000000.sdmp, qHqJcuLw.exe, 0000000C.00000002.2222420893.0000000003310000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000F.00000002.3362498072.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
182.50.135.77	sg2plcpnl0128.prod.sin2.secureserver.net	Singapore		26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482428
Start date and time:	2024-07-25 22:51:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 178 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.127.169.103, 13.85.23.206, 20.242.39.171
Excluded domains from analysis (whitelisted): client.wns.windows.com, fe3.delivery.mp.microsoft.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002A_2.exe

Simulations

Behavior and APIs

Time	Type	Description
16:52:49	API Interceptor	1x Sleep call for process: LisectAVT_2403002A_2.exe modified
16:52:52	API Interceptor	36x Sleep call for process: powershell.exe modified
16:52:54	API Interceptor	37x Sleep call for process: RegSvcs.exe modified
16:52:55	API Interceptor	1x Sleep call for process: qHqJcuLw.exe modified
22:52:54	Task Scheduler	Run new task: qHqJcuLw path: C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
182.50.135.77	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse
	rPURCHASEORDERPO-399.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	0044FIDB240149.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Financial Invoice Report - STI ME-3051-2024.exe	Get hash	malicious	AgentTesla	Browse
	EA1205-24-25607#U00a0QUOATATION.exe	Get hash	malicious	AgentTesla	Browse
	0044FIDB240149 swift.exe	Get hash	malicious	AgentTesla	Browse
	uF8wwjO0iU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	GCSG151347.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	RCP000004689 Scan Copy.exe	Get hash	malicious	AgentTesla	Browse
	RCP000004689 SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sg2plcpnl0128.prod.sin2.secureserver.net	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	rPURCHASEORDERPO-399.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	182.50.135.77
	0044FIDB240149.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	182.50.135.77
	Financial Invoice Report - STI ME-3051-2024.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	EA1205-24-25607#U00a0QUOATATION.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	0044FIDB240149 swift.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	uF8wwjO0iU.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	182.50.135.77
	GCSG151347.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	182.50.135.77
	RCP000004689 Scan Copy.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	RCP000004689 SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
api.ipify.org	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_481.exe	Get hash	malicious	Luna Grabber, Luna Logger	Browse	104.26.12.205
	LisectAVT_2403002A_63.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Re_ Q22689 - 07.24.2024_Conduit Construction Network Ltd_Today.eml	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002B_385.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	104.26.12.205
	LisectAVT_2403002B_390.exe	Get hash	malicious	AgentTesla, Bdaejec	Browse	104.26.13.205
	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	httP://151.28.168.184.host.secureserver.net/documento=24/07/2024/U04cVk3Ovkp..VkcI/6VnUVdvU8k1Oz8c2H4/maud.gaume@gmail.com-282072__;!!P3IToRM6tg!mhHYI3NP1FN47238PV4Ejpyi3ZOkGxwJydSJnD9HyjmCKYq9ZCB_iRj7Oz_yw96WdDsvl9wksR7V4C9z2rZDtUTV_FwEQ6ffgUAMko4$	Get hash	malicious	Unknown	Browse	184.168.28.151
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	166.62.6.144
	LisectAVT_2403002C_15.exe	Get hash	malicious	AgentTesla	Browse	148.66.145.151
	https://msms.live/index.php	Get hash	malicious	Unknown	Browse	118.139.181.13
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	192.169.151.159
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	192.169.151.159
	http://hwylovermk.shop/product_details/5509027.html	Get hash	malicious	Unknown	Browse	68.178.154.150
	Invoice Copy.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
CLOUDFLARENETUS	https://taf7.rphortan.com/xV5YqZuT/#Xjeffrey.laws@99restaurants.com	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	LisectAVT_2403002A_210.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	104.16.123.96
	Jeffrey.laws Replay VM (01m27sec).docx	Get hash	malicious	HTMLPhisher	Browse	172.64.151.101
	LisectAVT_2403002A_220.exe	Get hash	malicious	Unknown	Browse	104.21.6.108
	https://forms.office.com/Pages/ResponsePage.aspx?id=4Kydhlha3USXUsGxfRX-jBHWmjJmsZxDrR9zl3guaTNURU9US0pPQldQMFdROEtOVUJYRlJER1pIMi4u	Get hash	malicious	Unknown	Browse	104.17.25.14
	phish_alert_sp2_2.0.0.0-1.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	LisectAVT_2403002A_236.exe	Get hash	malicious	LummaC	Browse	104.21.48.252
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	104.21.11.245
	https://forms.office.com/r/qq9c20HBqa	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	LisectAVT_2403002A_312.exe	Get hash	malicious	HTMLPhisher	Browse	104.21.11.245

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LisectAVT_2403002A_220.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_308.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_333.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_368.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	172.67.74.152
	https://url.us.m.mimecastprotect.com/s/E8trC5yxE7iZK9MZ8-vl	Get hash	malicious	Unknown	Browse	172.67.74.152
	LisectAVT_2403002A_473.exe	Get hash	malicious	Njrat, XWorm	Browse	172.67.74.152
	LisectAVT_2403002A_449.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.74.152
	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qHqJcuLw.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\qHqJcuLw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379938008936079
Encrypted:	false
SSDEEP:	48:wWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:wLHyIFKL3IZ2KRH9Oug8s
MD5:	642B2BB8F5469D7ACA5D78625A941C0F
SHA1:	49568AFB92968078732FB3887F5923D7663CC073
SHA-256:	7411341730810200323C82351BA6FCD1CC9F497A8405B1EF61FD4CE1BD10B706
SHA-512:	E050BBE5B9FD8AEE05F5BCF9A1BE0F2C7FE851D9CC32546E90D50B1C9892882081F3AF0CCDF1563BED0B3C6E02962E7AE03E9C2F84C5692466CD1CE0EDAD389E
Malicious:	false
Preview:	@...e.................................X..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uhuktwx.pnf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fd0434iv.evp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ghcx1pe0.htk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwjhha2j.vou.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nl52yuir.5ok.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsaebg2q.oef.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfi4kfp0.y3h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjiaefui.gd1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpCF64.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_2.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.10178787731846
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLAJaxv:cge7QYrFdOFzOzN33ODOiDdKrsuTDv
MD5:	B0F67FF3F1180FA59D79CBE2968CFE0B
SHA1:	4C3C190336B405F00C282A005E932B75C5DA28A0
SHA-256:	C8FC249B3BDB10EDA7939EEA3DE3746F14C2049D6AA8E1E9D38DC5BECD93DD69
SHA-512:	27EA0DFF68316B10F74E8763833D81A962C67591722EB97A31EB15C50BB619CDDB07508C9207C6BB99A90B38BE9CCF012346840D4BEA0AF1D3F5D696CE15269D
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpE378.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\qHqJcuLw.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1595
Entropy (8bit):	5.10178787731846
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLAJaxv:cge7QYrFdOFzOzN33ODOiDdKrsuTDv
MD5:	B0F67FF3F1180FA59D79CBE2968CFE0B
SHA1:	4C3C190336B405F00C282A005E932B75C5DA28A0
SHA-256:	C8FC249B3BDB10EDA7939EEA3DE3746F14C2049D6AA8E1E9D38DC5BECD93DD69
SHA-512:	27EA0DFF68316B10F74E8763833D81A962C67591722EB97A31EB15C50BB619CDDB07508C9207C6BB99A90B38BE9CCF012346840D4BEA0AF1D3F5D696CE15269D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\qHqJcuLw.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_2.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	706056
Entropy (8bit):	7.886955353243016
Encrypted:	false
SSDEEP:	12288:HUzWSsykmrzmac+vB5yG5CWcV4NKeHe1+YuDqZFr1KY9bh4CMwjN:HSmykszmw75CZ+0eHek1q1KY93N
MD5:	E099AD7E57B0011262CC822808972E10
SHA1:	F2D3A518EBE54091351CED1D068DB43F4DC09056
SHA-256:	449B2930259030577C8AC1061E4FD12E815B06597F8A55BECF318EFD44EAC323
SHA-512:	AF7EEA1638CB1104F2D78E687F31B1C99E516D52E0CCD5324FBF9262E8A53A58AD8387A77871F3E7B83E5BDD8F51D9F146F7F58D46EB0025C2DDF05C2D98292D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@.....................................O.......................................p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........pu......`....%..............................................^..}.....(.......(......0..;.........{....o....(......{....o....(......{......X...(....o.......0..;.........{....o....(......{....o....(......{......Y...(....o.......0..;.........{....o....(......{....o....(......{......Z...(....o.......0..c.........{....o....(.........,=..{....o....(......{....o....(......{......[...(....o......+..r...p(....&...0..+.........,..{.......+....,...{....o........(......

C:\Users\user\AppData\Roaming\qHqJcuLw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.886955353243016
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	LisectAVT_2403002A_2.exe
File size:	706'056 bytes
MD5:	e099ad7e57b0011262cc822808972e10
SHA1:	f2d3a518ebe54091351ced1d068db43f4dc09056
SHA256:	449b2930259030577c8ac1061e4fd12e815b06597f8a55becf318efd44eac323
SHA512:	af7eea1638cb1104f2d78e687f31b1c99e516d52e0ccd5324fbf9262e8a53a58ad8387a77871f3e7b83e5bdd8f51d9f146f7f58d46eb0025c2ddf05c2d98292d
SSDEEP:	12288:HUzWSsykmrzmac+vB5yG5CWcV4NKeHe1+YuDqZFr1KY9bh4CMwjN:HSmykszmw75CZ+0eHek1q1KY93N
TLSH:	9DE402013EB85B93E6BA8BF81475649057B57A6F2831D31C9CD2A1DD2736F848BC1E23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4adae2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC6950FA3 [Mon Jul 29 20:27:15 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 35h
xor eax, 43465138h
push eax
xor eax, 38453452h
xor dl, byte ptr [ecx+eax*2+5Ah]
push esi
dec eax
dec eax
inc ebx
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xada8f	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xab584	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xabb00	0xabc00	0201554c0d028cec96519de696532f2f	False	0.9099359193049491	data	7.894347092736149	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x5c4	0x600	e408df321003f82c36705f83fc0a4875	False	0.4251302083333333	data	4.11762863617361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	65ade1692081cf4186da0e64d4fd049f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xae090	0x334	data			0.424390243902439
RT_MANIFEST	0xae3d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T22:53:05.892965+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49721	40.127.169.103	192.168.2.6
2024-07-25T22:53:43.946681+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49727	40.127.169.103	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 22:52:53.832690001 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:53.832731009 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:53.832799911 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:53.841579914 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:53.841614962 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:54.427356005 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:54.427421093 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:54.429425955 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:54.429438114 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:54.429749966 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:54.478553057 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:54.580528021 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:54.624500036 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:55.020905018 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:55.020970106 CEST	443	49714	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:55.022180080 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:55.028067112 CEST	49714	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:55.723870039 CEST	49715	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:52:55.728897095 CEST	587	49715	182.50.135.77	192.168.2.6
Jul 25, 2024 22:52:55.729006052 CEST	49715	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:52:57.866283894 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:57.866344929 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:57.866411924 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:57.870588064 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:57.870609045 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:57.920909882 CEST	587	49715	182.50.135.77	192.168.2.6
Jul 25, 2024 22:52:57.920990944 CEST	49715	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:52:58.465754032 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.465879917 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:58.467569113 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:58.467576981 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.467803001 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.525448084 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:58.572499037 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.643517017 CEST	49715	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:52:58.667929888 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.667999029 CEST	443	49718	172.67.74.152	192.168.2.6
Jul 25, 2024 22:52:58.668447018 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:58.672357082 CEST	49718	443	192.168.2.6	172.67.74.152
Jul 25, 2024 22:52:59.194823980 CEST	49719	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:52:59.199868917 CEST	587	49719	182.50.135.77	192.168.2.6
Jul 25, 2024 22:52:59.199958086 CEST	49719	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:53:01.361299038 CEST	587	49719	182.50.135.77	192.168.2.6
Jul 25, 2024 22:53:01.362600088 CEST	49719	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:53:01.456820011 CEST	49719	587	192.168.2.6	182.50.135.77
Jul 25, 2024 22:53:01.461657047 CEST	587	49719	182.50.135.77	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 22:52:53.720999002 CEST	51286	53	192.168.2.6	1.1.1.1
Jul 25, 2024 22:52:53.787518024 CEST	53	51286	1.1.1.1	192.168.2.6
Jul 25, 2024 22:52:55.709983110 CEST	50816	53	192.168.2.6	1.1.1.1
Jul 25, 2024 22:52:55.723084927 CEST	53	50816	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 22:52:53.720999002 CEST	192.168.2.6	1.1.1.1	0xb456	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 25, 2024 22:52:55.709983110 CEST	192.168.2.6	1.1.1.1	0x2779	Standard query (0)	sg2plcpnl0128.prod.sin2.secureserver.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 22:52:53.787518024 CEST	1.1.1.1	192.168.2.6	0xb456	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 25, 2024 22:52:53.787518024 CEST	1.1.1.1	192.168.2.6	0xb456	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 25, 2024 22:52:53.787518024 CEST	1.1.1.1	192.168.2.6	0xb456	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 25, 2024 22:52:55.723084927 CEST	1.1.1.1	192.168.2.6	0x2779	No error (0)	sg2plcpnl0128.prod.sin2.secureserver.net	182.50.135.77	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	172.67.74.152	443	7144	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 20:52:54 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-25 20:52:55 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 20:52:54 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a8f095188a072aa-EWR
2024-07-25 20:52:55 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49718	172.67.74.152	443	7056	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-25 20:52:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-25 20:52:58 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 25 Jul 2024 20:52:58 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a8f096a4a4d6a5c-EWR
2024-07-25 20:52:58 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	1
Start time:	16:52:48
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"
Imagebase:	0xca0000
File size:	706'056 bytes
MD5 hash:	E099AD7E57B0011262CC822808972E10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2177368651.0000000004CA2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2177368651.000000000437E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:52:50
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_2.exe"
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:52:50
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:52:50
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qHqJcuLw.exe"
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:52:51
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:52:51
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpCF64.tmp"
Imagebase:	0x7a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:52:51
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:52:52
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xb0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:52:52
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x690000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.2201120787.0000000002A6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.2198188143.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.2201120787.0000000002A41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:52:53
Start date:	25/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:52:54
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\qHqJcuLw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\qHqJcuLw.exe
Imagebase:	0xd00000
File size:	706'056 bytes
MD5 hash:	E099AD7E57B0011262CC822808972E10
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2224328592.00000000045DF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:52:56
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\user\AppData\Local\Temp\tmpE378.tmp"
Imagebase:	0x7a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:52:56
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:52:56
Start date:	25/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x770000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.3362498072.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.3362498072.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	214
Total number of Limit Nodes:	9

Executed Functions

Function 0751837C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93af1962fe4596dd7d8681ec21ade157615ab2584dc2775ee507f051ff2060d1
Instruction ID: 23808725e76e131c0e72d05cff6ee2984dc7e52ec9edc930510a0e361fbc6e31
Opcode Fuzzy Hash: 93af1962fe4596dd7d8681ec21ade157615ab2584dc2775ee507f051ff2060d1
Instruction Fuzzy Hash: 99D012B4C59548DFD710EF50C4845F8B7B8BB5B313F156855440A97311E63059448E84

Function 015CD070 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015CD0FE
GetCurrentThread.KERNEL32 ref: 015CD13B
GetCurrentProcess.KERNEL32 ref: 015CD178
GetCurrentThreadId.KERNEL32 ref: 015CD1D1

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 575057999b06e646613c4e7692e22757f979b358403b317f8b9257aebbede76c
Instruction ID: 71947a10846bc8412f8a7cc2e02508a218dfc8ce41523dfc2b5439fd89d1b7ae
Opcode Fuzzy Hash: 575057999b06e646613c4e7692e22757f979b358403b317f8b9257aebbede76c
Instruction Fuzzy Hash: 295145B0900249DFEB54CFAAD548B9EBBF1FB88314F208419E519AB360DB385944CF65

Function 015CD080 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015CD0FE
GetCurrentThread.KERNEL32 ref: 015CD13B
GetCurrentProcess.KERNEL32 ref: 015CD178
GetCurrentThreadId.KERNEL32 ref: 015CD1D1

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 27e525d058aa39dff3dd42be97a02bc230dbc85e6fe73106e8b9964a6b9c406d
Instruction ID: 10623bf0d17af90cff0e6f08d532c72bd7cecde17a85c98320b59cadd3c25bf4
Opcode Fuzzy Hash: 27e525d058aa39dff3dd42be97a02bc230dbc85e6fe73106e8b9964a6b9c406d
Instruction Fuzzy Hash: 835134B0900649DFEB54CFAAD548BAEBBF1BB88314F208419E509AB360DB345944CF65

Function 07514A5C Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07514C9E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 22776d2e79960f3950f7912593d436c40c60e4299b49729a686e18eb14f08bde
Instruction ID: 6e46163ba842339fbb6e4f1d74c45f676da32567bb6cd47d09a2b5fce881941f
Opcode Fuzzy Hash: 22776d2e79960f3950f7912593d436c40c60e4299b49729a686e18eb14f08bde
Instruction Fuzzy Hash: 4FA17FB1D0025ACFEF24DFA8C8417EDBBB2BF44315F04816AE848A7240DB749985CF91

Function 07514A68 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07514C9E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: abb21927b9da71fdfa984db0edd8a6e5678b5a4bdb91516a1ccc098b46d5581d
Instruction ID: c82f6afd56bcc2703839110ccf00bd20247538bbe74ac533694b6489a4b6aefe
Opcode Fuzzy Hash: abb21927b9da71fdfa984db0edd8a6e5678b5a4bdb91516a1ccc098b46d5581d
Instruction Fuzzy Hash: 2E915EB1D0025ADFEF24DFA8C8417DDBBB2BF44315F14856AD848A7280DB749985CF91

Function 015CADE8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 015CB03E

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 112d507efeaf9610408343edd9188e6ff501665ddad907c375a07e47d999f13f
Instruction ID: 5db535abf8f617b546a78fb111b7a75a80c55fed043027845d2ca304c68aa992
Opcode Fuzzy Hash: 112d507efeaf9610408343edd9188e6ff501665ddad907c375a07e47d999f13f
Instruction Fuzzy Hash: B2715970A00B0A8FD724DFA9D45575ABBF1FF88600F00892DD596DBA40E734E849CF95

Function 015C44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015C59C9

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9505c20caa6ba11081a8a241ebe185c655855b876ba98b21f2f1e6461c4853c1
Instruction ID: 04268e5d564caa062a188ad8bdb2d14cc3ea0d778c53861ec5b027f251df2ad9
Opcode Fuzzy Hash: 9505c20caa6ba11081a8a241ebe185c655855b876ba98b21f2f1e6461c4853c1
Instruction Fuzzy Hash: 7F41DE70D00719CFEB24CFAAC884BCEBBB5BF49704F20816AD508AB255DBB16945CF91

Function 015C590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015C59C9

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6a1cecde4ce98939417cdbc6c5ea8db2f23d65f4f4ef1bc0cdaac83a2f44e59e
Instruction ID: 6ee8faeeed522db8cd4d2189aef7a5072de2b80c652e23c3631092d663b82b80
Opcode Fuzzy Hash: 6a1cecde4ce98939417cdbc6c5ea8db2f23d65f4f4ef1bc0cdaac83a2f44e59e
Instruction Fuzzy Hash: B741D0B0D00719CFEB24CFAAC884BCEBBB5BF49704F20816AD508AB255DB756946CF51

Function 075147D8 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07514870

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 05f7e2d903fd1b0d691219248c8e153603b2fdb7e4763be431c58f8a318bd03b
Instruction ID: dd94a51b95945c9eba667981e3d45fd4f31fa46a7cdaa3da68420b5ab5761316
Opcode Fuzzy Hash: 05f7e2d903fd1b0d691219248c8e153603b2fdb7e4763be431c58f8a318bd03b
Instruction Fuzzy Hash: 8A2148B19003499FEB10CFA9C881BDEBBF5FF48310F10842AE958A7640C7789541CBA4

Function 075147E0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07514870

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7acf994c7c892faa631a0fc7ca276c34ad8989d69103fe629da7d5881e79bbb8
Instruction ID: 6a4477162800f7dcd1a02f5756d38db28447c9aacff6986d3b456317648bc874
Opcode Fuzzy Hash: 7acf994c7c892faa631a0fc7ca276c34ad8989d69103fe629da7d5881e79bbb8
Instruction Fuzzy Hash: 0E21F6B19003599FEB10DFA9C885BDEBBF5FF48310F10842AE959A7240C7789954CBA5

Function 0751420A Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0751428E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4ffc3473404ad9906613d575d752fe2e7043c99083e402ab3ea1f778cd2bf997
Instruction ID: 0c0b7dfbd305fc4bdfd091815b87fa2fbf0b731793b1893114647d7c9bcee7e7
Opcode Fuzzy Hash: 4ffc3473404ad9906613d575d752fe2e7043c99083e402ab3ea1f778cd2bf997
Instruction Fuzzy Hash: 622168B19003499FEB10CFAAC4857EEBBF4FF88320F14842AD559A7240CB789945CFA5

Function 075148C9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07514950

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 64fc816426faca69b6bcbd0df0f02408fd10b2f6e11a8ff5dc676f965a4ef6eb
Instruction ID: 4ba3ec1f1398169d83143fa1e0c45fa970dd9fa3c8d30659c8ae25e108d1893d
Opcode Fuzzy Hash: 64fc816426faca69b6bcbd0df0f02408fd10b2f6e11a8ff5dc676f965a4ef6eb
Instruction Fuzzy Hash: C52116B18003499FDB10DFAAC881BEEBBF5FF48310F10842AE958A7250C7789941CBA5

Function 07514210 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0751428E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a13608435269ca412dc9114e48e701908f7c79ede6f8e57cd3bbc3ad55a23d09
Instruction ID: 76ff6d5b9b16df634d41a1879036032129d9e85345052fc2e1a37f3438d22212
Opcode Fuzzy Hash: a13608435269ca412dc9114e48e701908f7c79ede6f8e57cd3bbc3ad55a23d09
Instruction Fuzzy Hash: AC2147B19003499FEB10CFAAC4857EEBBF4FF88310F14842AD559A7240CB789944CFA5

Function 075148D0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07514950

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4a47927527d8aade9ca6033075e54346d4c8f4e546a495f95d9a269d1687fd40
Instruction ID: 6d2f155162172a57237279e3940b9f131b64a3be7d67c6e0f22ce26ffe141578
Opcode Fuzzy Hash: 4a47927527d8aade9ca6033075e54346d4c8f4e546a495f95d9a269d1687fd40
Instruction Fuzzy Hash: 992125B18003499FDB10CFAAC881BEEBBF5FF88310F10842AE558A7240C7389900CBA5

Function 015CD6C8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015CD757

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d0c3e2d0f09d1b90834513e93710fa31aa139e0d5bc8643e229e4ad436b519c
Instruction ID: b307c763e5ff30c68f0fb16e42adb6ae4a51b1ba964c075be9485492c17e9d99
Opcode Fuzzy Hash: 1d0c3e2d0f09d1b90834513e93710fa31aa139e0d5bc8643e229e4ad436b519c
Instruction Fuzzy Hash: 2721D2B5900249DFDB10CFA9D985ADEBBF4AB48214F14841AE958B7310D378A944CFA5

Function 015CD6D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015CD757

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4d3cbf4599535522aad752581ac2f5765b0e67ccc5ce359e4e6159eac195efb8
Instruction ID: 07e45e33fc57f93db7d4f993a518a75634ddc9364d3db18bb878bec625d85446
Opcode Fuzzy Hash: 4d3cbf4599535522aad752581ac2f5765b0e67ccc5ce359e4e6159eac195efb8
Instruction Fuzzy Hash: 4421E4B5900248DFDB10CFAAD984ADEBBF8FB48710F14841AE918B7310D378A944CFA5

Function 015CB071 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 015CB03E

Part of subcall function 015CA170: LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,015CB0B9,00000800,00000000,00000000), ref: 015CB2CA

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: b2570a6b693b3975bc06a7d73c7c1ef3f98736c0e3a1934f186c83eafd356268
Instruction ID: e054e59810762d15fe5e48ff9acdd3690d67ca8a8ce86e2a935adee77c354cb2
Opcode Fuzzy Hash: b2570a6b693b3975bc06a7d73c7c1ef3f98736c0e3a1934f186c83eafd356268
Instruction Fuzzy Hash: E01182756002059FE714DF9AD841BDBBBF9FBC4754F04846DD514EB250C778A805CBA1

Function 015CA170 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,015CB0B9,00000800,00000000,00000000), ref: 015CB2CA

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4bd36de350edcfff2c2c53f4609716158ab93104f3821b59fd8060f7a74b3352
Instruction ID: 5948ef83ae316e452cf009fdfbb825eb15324510715017298c9f917b97f3f579
Opcode Fuzzy Hash: 4bd36de350edcfff2c2c53f4609716158ab93104f3821b59fd8060f7a74b3352
Instruction Fuzzy Hash: BC1103B69002499FDB10CF9AC485B9EFBF9FB88750F10842ED519AB200C375A545CFA5

Function 015CB258 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,015CB0B9,00000800,00000000,00000000), ref: 015CB2CA

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8bc36c59cc55ad3ae914d1fd4b7512ddf3f8cdc37c20993095464d1dabb44289
Instruction ID: 6e3a7e0799890c423d8de94724825059b576e23b4bb67c7c81f1c80d1dfe8f76
Opcode Fuzzy Hash: 8bc36c59cc55ad3ae914d1fd4b7512ddf3f8cdc37c20993095464d1dabb44289
Instruction Fuzzy Hash: D71103B68002499FDB10CF9AC885BDEFBF9EB88710F10841ED519A7200C379A545CFA5

Function 0751471A Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0751478E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: de0f8d061734ffa8a85dbef02576ba1911dd6b229a61589dd2d192478bcc7153
Instruction ID: ac1343604f6ef37054199245a6d2b9cf6613bd417e1226f6e6b7be007a6ae8fb
Opcode Fuzzy Hash: de0f8d061734ffa8a85dbef02576ba1911dd6b229a61589dd2d192478bcc7153
Instruction Fuzzy Hash: 6A115671900289DFEB10CFAAD845BEEBBF5EF89320F14881AE555A7250C7359501CFA0

Function 0751415A Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 075141C2

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7c3d714fb2998420dbfe6b46bc602aeaa42903e78c95cf8ce2fb0b8683f82233
Instruction ID: c30311e3988ea1236acf698c4e9868a6afebc6b59adb2b227723d9750a52faf1
Opcode Fuzzy Hash: 7c3d714fb2998420dbfe6b46bc602aeaa42903e78c95cf8ce2fb0b8683f82233
Instruction Fuzzy Hash: C4115BB19003499FEB10DFAAC8457DEFBF4EF88710F24841AD519A7640CB359540CBA5

Function 07514720 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0751478E

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ef876589c39f3f4e9c5fd700eb8276485131d1fb40c389e522fd1e389b481b73
Instruction ID: 0046435ea48daf3656259a4879bc0088b12457f1d7342002202d3f3a726719b0
Opcode Fuzzy Hash: ef876589c39f3f4e9c5fd700eb8276485131d1fb40c389e522fd1e389b481b73
Instruction Fuzzy Hash: F9115671800349DFEB10CFAAC845BDEBBF5AF88320F148819E515A7250C7359500CBA4

Function 07514160 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 075141C2

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b929172a508145d9d233f74fd62b745468d0d64137f0542f7c5154fb3f4b35a3
Instruction ID: fb39f173358c45ab366dfb3120e9c2a9145a13b6ad014e7435b03a4a6784080c
Opcode Fuzzy Hash: b929172a508145d9d233f74fd62b745468d0d64137f0542f7c5154fb3f4b35a3
Instruction Fuzzy Hash: D3113AB19003498FEB10DFAAC8457DEFBF4AF89710F258819D519A7240CB79A544CBA5

Function 07518B4C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07519305

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fbebc7f68b1b530b6c9e8c28ce7720bf0663ab32c62dad1a4c1ac5a6734cf6cf
Instruction ID: 931955408a1734e90d309d77e82949de05fa0a7c381f80b566c52d6ccfcf2c5f
Opcode Fuzzy Hash: fbebc7f68b1b530b6c9e8c28ce7720bf0663ab32c62dad1a4c1ac5a6734cf6cf
Instruction Fuzzy Hash: 3711F2B5800349DFEB10CF9AC895BDEBBF8FB48314F10885AE559A7240C375A944CFA5

Function 075192A2 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07519305

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 25c3df0fea52a1e477eb094a87a740cf5f7c475accfdf382683441db9f1f63ca
Instruction ID: 83e0afaf336bd51ccaf19b18b6139bec9a6ba718bd04f7a53ef888d585a8c644
Opcode Fuzzy Hash: 25c3df0fea52a1e477eb094a87a740cf5f7c475accfdf382683441db9f1f63ca
Instruction Fuzzy Hash: FC11F2B5800349DFEB10CF9AD885BDEBBF8FB48324F14845AE558A7640C375A544CFA5

Function 015CAFD8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 015CB03E

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b9128d3a275d91d0cdd59ec5899073e708e4c624078930ad20f7de0687b7a0d2
Instruction ID: 204fb979f385bff73969059c80be29c1b5404a16cdcdf471dd6aed6b8a02f43a
Opcode Fuzzy Hash: b9128d3a275d91d0cdd59ec5899073e708e4c624078930ad20f7de0687b7a0d2
Instruction Fuzzy Hash: 7E110FB5C00749CFEB10CF9AD445BDEFBF8AB88610F10841AD528B7200D379A549CFA5

Function 0152D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9560f9eb32d232b0345df6abfb6109fcf864ba356fd56182b6be12fa5345c70
Instruction ID: a56e5d3baf6deec97dbb4afdc753470c29b64467bba65394a0eb2510dca9fbea
Opcode Fuzzy Hash: d9560f9eb32d232b0345df6abfb6109fcf864ba356fd56182b6be12fa5345c70
Instruction Fuzzy Hash: FF21F172504204EFDB05DF54D9C0B6ABBB5FB89324F20C569E9090F296C37AE456CAE2

Function 0152D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7485e45ea74a8cfc0361fbc33f79bd10a04a2af4fe916c72b31e637cb1aca44
Instruction ID: 89f162d4763889794f03b43ace478a7157e8bba4ffaa7cc47c7d60057711dfa5
Opcode Fuzzy Hash: c7485e45ea74a8cfc0361fbc33f79bd10a04a2af4fe916c72b31e637cb1aca44
Instruction Fuzzy Hash: 22212572604240EFDB05DF58D9C0B2ABFB5FB89318F20C56DE9090F296C376D456CAA2

Function 0153D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175883685.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9b33fa0c3335a355615017c309a173e5af679ef9f1ebb3dad26e2d233df836
Instruction ID: 0d566d5147b2ac4c67b2b1d9c0715bc1feece681c3c087b3b6efc6a7ee21d3e4
Opcode Fuzzy Hash: 1d9b33fa0c3335a355615017c309a173e5af679ef9f1ebb3dad26e2d233df836
Instruction Fuzzy Hash: 2C210771504204EFDB05DFA4D5C0B25BBB5FBC4324F60C96DE9094F252C37AD446CA61

Function 0153D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175883685.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9563a8c7ba8fcd0862783ecf6762156e6a5c61bcab47d1021d6042d4f219c08e
Instruction ID: 6984e7019e0c1447d70adc1a07d0b88dd0d2634f9c7bb42a8f727388487afcca
Opcode Fuzzy Hash: 9563a8c7ba8fcd0862783ecf6762156e6a5c61bcab47d1021d6042d4f219c08e
Instruction Fuzzy Hash: C421F171604204EFDB15DF64D580B26FBB5FB84714F60C96DD9090F242D33AD446CA61

Function 0153D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175883685.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025b128e1c1bd7656c0caa7c02c413428d0c4b32f22ab3c471af9f62b1fcb380
Instruction ID: b5a3af4765eec9e9ce2de0ade7b80de341656e4ed7cea4e5f1c379ea61033447
Opcode Fuzzy Hash: 025b128e1c1bd7656c0caa7c02c413428d0c4b32f22ab3c471af9f62b1fcb380
Instruction Fuzzy Hash: AA2180755093809FCB02CF64D990715FF71FB86214F28C5DAD8498F2A7C33A980ACB62

Function 0152D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: 09486868eba3aefc23b2c3df1c0de8e68683f8a4b5831477aa826725d4092611
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: CA11CD72504280DFDB02CF44D9C0B5ABF71FB84224F2482A9D8090E257C37AE45ACBA2

Function 0152D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: d43f027a2c59247207fc34928a48c45ab0fd725d28c76bbf22456cbdcf9b17d9
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: EC11CD72504280DFCB02CF54D5C0B1ABF71FB84214F24C6A9D8090F256C33AD45ACBA2

Function 0153D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175883685.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: 1c5f686fc57cc9a92e751c43a5e436b48440ac877a028ef006165da07ca8b913
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: 3011A975904280DFCB02CF54C5C0B19BBB1FB84224F24C6A9E8494F296C33AD40ACB62

Function 0152D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34d506d788bbde4c8378e0bba96819ced26b0fdbc198a8ea157fa0c4799ad9b
Instruction ID: 086d80bc416a0a6ccc364670c34d2d09f80ac37f37ec0558b449371085261577
Opcode Fuzzy Hash: d34d506d788bbde4c8378e0bba96819ced26b0fdbc198a8ea157fa0c4799ad9b
Instruction Fuzzy Hash: 8601D4320043909AF7104EA9C984B6ABFE8FF42220F08891AEE080E2C6C67D9440C6B1

Function 0152D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2175792880.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_152d000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186a5f3b84de12accb408ef6b0bf0310362af4d72b568f998536d88ec5f8ae3c
Instruction ID: 82f697422371af94c7c93067c7935f7dd1faec02972b3a871c15fda2a2342316
Opcode Fuzzy Hash: 186a5f3b84de12accb408ef6b0bf0310362af4d72b568f998536d88ec5f8ae3c
Instruction Fuzzy Hash: D7F0C272004394AEF7118E59C884B66FFA8EB82734F18C45AED480E287C27D9844CAB1

Non-executed Functions

Function 0751A858 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf6f452a78e0343a16c9dae8a7c8c03cc97c3524473fa262fc47f44b95f7d19
Instruction ID: 1091ec70b388b5d0606781fcb06ccc42d2ba1b7add4f5ab1f1f041870cb7fc5a
Opcode Fuzzy Hash: 2cf6f452a78e0343a16c9dae8a7c8c03cc97c3524473fa262fc47f44b95f7d19
Instruction Fuzzy Hash: CFC1CCB07022468FEB1ADB75C450BAEB7F6BFC9606F14846EC146CB290DB34E801CB91

Function 07511CF1 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e601d6166e704074e62809344f008f80cf9e0c217aeb2ab9595a218d19b5cb29
Instruction ID: 2af33778228949b579ac70314b0470de7b730fb01c39cd352827bf36c934ff77
Opcode Fuzzy Hash: e601d6166e704074e62809344f008f80cf9e0c217aeb2ab9595a218d19b5cb29
Instruction Fuzzy Hash: 6EE1EBB4E002598FDB14CFA9C5809AEFBB2FF89305F24C169D914AB355D734A942CFA1

Function 075142E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1660624d815493d041b0f8f2f89b22d32f927cf6f01a2cfa626af2e1ef703d
Instruction ID: c25cedcf61528130058a705a7cba40c3a213f928b9f8b970e0e3cf5604b0bdb1
Opcode Fuzzy Hash: 1d1660624d815493d041b0f8f2f89b22d32f927cf6f01a2cfa626af2e1ef703d
Instruction Fuzzy Hash: 65E1EAB4E002598FDB14DFA9C5809AEFBB2FF89305F248169D814AB355D735AD42CFA0

Function 07512138 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02d4533b3b489a0e47b38c696966120c75f0bff1108020cde039eed0b8c069d
Instruction ID: e2f978cef4a0ad9d30d2ed291150d8991419016f64efca0bf218d6ac4388f1d7
Opcode Fuzzy Hash: d02d4533b3b489a0e47b38c696966120c75f0bff1108020cde039eed0b8c069d
Instruction Fuzzy Hash: C9E1DBB4E002198FDB14CFA9C5809AEFBB6FF89305F24816AD814AB355D735AD41CF61

Function 07513938 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579e6e839d4c9ae72de5025ea9a8b4abf6cb3d66616b3381c53c6a415d214bcc
Instruction ID: 6327484f12b5eea0ca5dacd1cd50d014e0cd77295923706e464070d40a543951
Opcode Fuzzy Hash: 579e6e839d4c9ae72de5025ea9a8b4abf6cb3d66616b3381c53c6a415d214bcc
Instruction Fuzzy Hash: 76E1D9B4E002598FDB14CFA9C5909AEFBB2FF89305F24816AD814AB355D735AD41CFA0

Function 075118C8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71122e59f06182e9dc946c7bdfd725fe232f2da29a248d67b24c04a60753c842
Instruction ID: 5717b83017c479c960c5477affc6000054b62f46331ad2498f7b403366324172
Opcode Fuzzy Hash: 71122e59f06182e9dc946c7bdfd725fe232f2da29a248d67b24c04a60753c842
Instruction Fuzzy Hash: 47E1DAB4E046198FDB14CFA9C580AAEFBB2FF89305F24816AD514AB355D734AD41CFA0

Function 015CD5FC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2176247592.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15c0000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b981eceb49e6cad5cee9d0506950271207e0223549d33a2be4dc55509f1c6816
Instruction ID: ef8cc1b5a09467caa958e839a14c852731ea3896939e8f14fb061501ef82314b
Opcode Fuzzy Hash: b981eceb49e6cad5cee9d0506950271207e0223549d33a2be4dc55509f1c6816
Instruction Fuzzy Hash: 03A15B36A002168FCF05DFB8C84459EBBB3FF85700B15856EE906AF265DB75E946CB40

Function 07513928 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2182727714.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7510000_LisectAVT_2403002A_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa223509e28cd0b47bbdf6ff8076f918b4430adb2d2f3d9f491232a6c3a5a97
Instruction ID: 0fe839330b1208a7626d59dddeff33671fecbf354df79354a6c34d564380f11b
Opcode Fuzzy Hash: faa223509e28cd0b47bbdf6ff8076f918b4430adb2d2f3d9f491232a6c3a5a97
Instruction Fuzzy Hash: B65108B4E002598FDB14CFA9C9909EEFBB2FF89305F24C16AD418A7255D7349942CFA1

Analysis Process: RegSvcs.exePID: 7144, Parent PID: 6488COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	5

Executed Functions

Function 062C5640 Relevance: 1.8, Strings: 1, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 062C5CBC

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: ec6af847e1af3248b09a98f684527a5197f4ae5cd2df73dcc64f14d315d826e7
Instruction ID: 8a6066cafd75da630c014716ae4566eff368f9d412cbfb01db7cadb1eaac6c5a
Opcode Fuzzy Hash: ec6af847e1af3248b09a98f684527a5197f4ae5cd2df73dcc64f14d315d826e7
Instruction Fuzzy Hash: 5122C175F202568FDB60DBA4D4446AEB7B2FF84320F208669D845BB345DB31ED51CB90

Function 062C2420 Relevance: 1.0, Instructions: 985COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3df30a5daa43425e2ca9d52b1399459ae33e64d1773114a6898aaaa5c00bc98
Instruction ID: 75d9fc2eb45275ff906b5b10f7f03bbc8f049380306c06615f8af90c7300b6f8
Opcode Fuzzy Hash: a3df30a5daa43425e2ca9d52b1399459ae33e64d1773114a6898aaaa5c00bc98
Instruction Fuzzy Hash: 27924730A11206CFDB64DF68C584A5DB7F2EB45324F54CAA9D809AB3A1DB75ED81CB80

Function 062C6690 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b2d34ad7dbe7e4c7cf952b4b2be5e336c8ba8c31f7398c1041ef4b75b82319
Instruction ID: 30bd21db71aba7189db4a7303ed1a4572f42dc2f8399f2ddd21ed7aeaafac86b
Opcode Fuzzy Hash: a1b2d34ad7dbe7e4c7cf952b4b2be5e336c8ba8c31f7398c1041ef4b75b82319
Instruction Fuzzy Hash: 3662BF30B202168FDB54DB68D554BADB7F2EF88320F148669D806EB395DB35ED42CB90

Function 062CC228 Relevance: .6, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e59abb94087fce1ff2e6984b1d97b1b22549b271f622168ab8333ff26451e3
Instruction ID: 8bdeb8515049c3e6c64629e31af8e34b7310353fb138873367b99d99c3272788
Opcode Fuzzy Hash: 53e59abb94087fce1ff2e6984b1d97b1b22549b271f622168ab8333ff26451e3
Instruction Fuzzy Hash: CD326535B102068FDB54DB68D890BADB7B2FB89320F148629D909EB355DB35DC42CF91

Function 062CB2C8 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60606e58f5215a0661f9350fcbeb38715386e7bc152b9f9f128e88a13aa32c57
Instruction ID: d396a3b28be8fc6e992a39c338ba4ebaa8793bfa0325992a4a41f6cca2dd58fb
Opcode Fuzzy Hash: 60606e58f5215a0661f9350fcbeb38715386e7bc152b9f9f128e88a13aa32c57
Instruction Fuzzy Hash: 84228A30E2010A8FEF64DB68D4917ADB7B2FB49321F208629E849DB355DB35DC81DB91

Function 062C30F8 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41d22582e70d2b865b97ac6be43a6df4a3afe3dde4ccb522a3ac4089285710f
Instruction ID: e5477c34ddf3830d11ff0e12557f63bc368dcbbe3b443ed081b2a2631e75f158
Opcode Fuzzy Hash: e41d22582e70d2b865b97ac6be43a6df4a3afe3dde4ccb522a3ac4089285710f
Instruction Fuzzy Hash: 0B321F31E1075ACFDB14EB74C85459DB7B2FF89310F60CB6AD40AAB254EB70A985CB80

Function 062C7E20 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43822e8b5b27989ed342e82ce0e874ea9b93f0dfee5e2bec07439ae737ddb9ee
Instruction ID: 763a3435d4b4b0518deb4939458ef4cda095b901b6daa575e20255419d59bbe6
Opcode Fuzzy Hash: 43822e8b5b27989ed342e82ce0e874ea9b93f0dfee5e2bec07439ae737ddb9ee
Instruction Fuzzy Hash: 3D029030B112168FDB54DB68E4946AEBBF2FF84310F14C669E905AB345DB75EC42CB90

Function 062CAD70 Relevance: 2.9, Strings: 2, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dM, xrefs: 062CB10F
dM, xrefs: 062CB1F0

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID: dM$dM
API String ID: 0-2801238145
Opcode ID: 0c538359b1e3e6e3d63f053ba18f287ffb2033e2685627745174481a97b8f421
Instruction ID: b33d006ddb85be189f127d5b600e5181b548a047aa12fd9a47c0a6653c2afc6c
Opcode Fuzzy Hash: 0c538359b1e3e6e3d63f053ba18f287ffb2033e2685627745174481a97b8f421
Instruction Fuzzy Hash: E6E15E30E2030A8FDB64DB64D4906AEB7B2FF89311F20862ED805EB355DB719C46CB91

Function 00EDE928 Relevance: 2.0, APIs: 1, Instructions: 543
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2200234740.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ed0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f2928b74e88a07da953528e66354ff07d6738e04c4e6eb371684a18e3780bd
Instruction ID: 0cc6c021f21c57b5ad088a38e4a585cfe4ce7622814d70355bc8559bdaefbc83
Opcode Fuzzy Hash: 57f2928b74e88a07da953528e66354ff07d6738e04c4e6eb371684a18e3780bd
Instruction Fuzzy Hash: 1B413272D007898FCB14DFB9D80429ABBF1EF89310F14856BD804BB341EB389845CBA1

Function 00EDED40 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00EDEDA7

Memory Dump Source

Source File: 0000000A.00000002.2200234740.0000000000ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ed0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9fa91c7bdce5a919654ace413ef17e910f357ef1cf80797f3ce1bdd829d111a5
Instruction ID: d16a4b2982be819ea93b777f61dcf4d3ba866b17104ffd4c9ed10db87b2a225c
Opcode Fuzzy Hash: 9fa91c7bdce5a919654ace413ef17e910f357ef1cf80797f3ce1bdd829d111a5
Instruction Fuzzy Hash: DA110DB1C0065ADBDB10DFAAD444B9EFBF4AF48320F11812AE918B7340D778A944CFA5

Function 062CFD11 Relevance: 1.4, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 062CFD14

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: ff9b4260e6f60291820fa13acf58048a53354fca98a5431f11de922a598c20d5
Instruction ID: 708d2c006e541cd5e07e50ca3bd123178077cb547794816070a39914bb50a620
Opcode Fuzzy Hash: ff9b4260e6f60291820fa13acf58048a53354fca98a5431f11de922a598c20d5
Instruction Fuzzy Hash: 3F51F531E112069FDB14EB78E9486ADB7B3EF85321F10497EE906E7291DB358855CB80

Function 062CCFD8 Relevance: .8, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7787dc7853c890c39c2100983d880201770f5b35cf0250b3f83e51e0faa944e
Instruction ID: 5138fe4dedcab4a86c841f976017b1cec80a5fdc7da28a1d05291c6b9bc386b0
Opcode Fuzzy Hash: e7787dc7853c890c39c2100983d880201770f5b35cf0250b3f83e51e0faa944e
Instruction Fuzzy Hash: 05622D30A10246CFDB55EB78E590A9DB7B2FF85310F208A69D4099F359EB71ED46CB80

Function 062CB6E8 Relevance: .5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6434236527e9160082f3b6cc47edeed11ac895f9de5baf1f346173e6365ce1d4
Instruction ID: 4248d421acf9069b50ee9d8b3bca82328d3e839d6b0bd6404917859e19d51260
Opcode Fuzzy Hash: 6434236527e9160082f3b6cc47edeed11ac895f9de5baf1f346173e6365ce1d4
Instruction Fuzzy Hash: B0026E30E2020A8FDFA4DB68D4917ADB7B2FF45321F208A2AD819DB255DB71DD45CB81

Function 062C91F0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeef9f45d58cf87f35efb95c3db37f589fd4f18bb338376c0c9e5c270261f459
Instruction ID: f6abbbe9389c9b9c96f6258a30cc95011c74c9347aa10996580de7e3709d2adb
Opcode Fuzzy Hash: eeef9f45d58cf87f35efb95c3db37f589fd4f18bb338376c0c9e5c270261f459
Instruction Fuzzy Hash: 59914030F1025A8FDB54DB69D850BAE73F6FF85310F108569D809AB348EF719D828B91

Function 062C6290 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329092f45269ade2d9161e92503c52a308c912418d7016e36cdd3282c4008927
Instruction ID: 6b0014ff0c2fa1421e161e298088e442ec412d78b502ed1a4fbb67ed446472ee
Opcode Fuzzy Hash: 329092f45269ade2d9161e92503c52a308c912418d7016e36cdd3282c4008927
Instruction Fuzzy Hash: DD61F472F101224BDF509A7DD8546AFBAD7EFC4620B25403AE80EDB320DEA5EC0287D1

Function 062C4338 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2904edd7ac59cd379b4a204c68947cf2619f2b452a428a38cde9360e36b43be
Instruction ID: 544e614eb3e723a2bd9b6d5ffbb76e012475b9937a79e1e112a28f2fcf64f3f1
Opcode Fuzzy Hash: c2904edd7ac59cd379b4a204c68947cf2619f2b452a428a38cde9360e36b43be
Instruction Fuzzy Hash: 9B813F30B116468FDB54EBA8D46479EB7F3EF89310F248529D80AEB344EB75DC428B91

Function 062C4658 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6be9e1985aa4d2ec321fc43096d63034c28a919af54b473f7010f299cca469
Instruction ID: 9cbd9f0730474733ade2454dfc1897ed9b8084b2bfd1d8d1e3aaaf5be386927d
Opcode Fuzzy Hash: cd6be9e1985aa4d2ec321fc43096d63034c28a919af54b473f7010f299cca469
Instruction Fuzzy Hash: 09915F30E1021A8FDF60DF68C850B9EB7B1FF89310F208699D549BB255DB70AA85CF91

Function 062C4670 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3269993a6370361323f89411b178c178538c734c9637addd4f5f4588bf49d
Instruction ID: 6ca07ed3b4e6904fac0cd2641406b1d4cfe1daf34dacdfdbf5b05b72be527c96
Opcode Fuzzy Hash: 2ed3269993a6370361323f89411b178c178538c734c9637addd4f5f4588bf49d
Instruction Fuzzy Hash: D9911D34E1061A8BDF60DF68C850B9EB7B1FF89310F208699D949BB355DB70AA85CF50

Function 062CEBA0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51059337ffc036ddbea60b3788a4f4ca69aa2b16c899c1b5a429ec4b694fa421
Instruction ID: 70059f98f9d44fd35d819809ff0f1d93cb985fa293040f9d4f9095ccc01d2427
Opcode Fuzzy Hash: 51059337ffc036ddbea60b3788a4f4ca69aa2b16c899c1b5a429ec4b694fa421
Instruction Fuzzy Hash: B0715F71A102498FDB54EFA8D890AADBBF6FF88310F258529E445EB355DB30ED46CB40

Function 062CEBB0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14537ac0c71848553c8a0e99668ec86d6e15894c5427f683b64a0cd7fcd3f64d
Instruction ID: 4a82084e721d7a0817fbd06ece15aada81ab74a29fd1829bf1711fd1093bdc2b
Opcode Fuzzy Hash: 14537ac0c71848553c8a0e99668ec86d6e15894c5427f683b64a0cd7fcd3f64d
Instruction Fuzzy Hash: 4A714030A102098FDB54EFA8D890AADBBF6FF88310F158529E449EB355DB30ED46CB50

Function 062C4C08 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd602b405ebcd1cf495ad7b560cfd61732489fb8fe140a74cef4091b6a71db8b
Instruction ID: be796faeb523366324f9d478e2441812718e4f27159a0f4fde3d6813a835e825
Opcode Fuzzy Hash: cd602b405ebcd1cf495ad7b560cfd61732489fb8fe140a74cef4091b6a71db8b
Instruction Fuzzy Hash: 2F61B630F102199FDB54EBA5D4547AEBBF2EF88310F208529E50AEB395CB714D018B90

Function 062CFAC0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2b820cdf391a480df2304b28a963117472ad3de860c8c82cdac0c8dc0c1b82
Instruction ID: fefa5a02219a09fbe7fac259d7f4e2078e7468f2ff166d6c020f5b638683233a
Opcode Fuzzy Hash: 6d2b820cdf391a480df2304b28a963117472ad3de860c8c82cdac0c8dc0c1b82
Instruction Fuzzy Hash: 5851EE30B201158FFF64A66CD96472F3667DB9A350F20453EE90ADB3D5CA68CD418792

Function 062CFAD0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdaa08146e1bc08789aeadfe7c7198b5fe2ad2da91ec2b69c22532ff8ee33a8f
Instruction ID: 4b0ab52eb9e9e9d2e8e3e5e55ce9e6404b56be4577a68492dd01a8db619ba5c7
Opcode Fuzzy Hash: bdaa08146e1bc08789aeadfe7c7198b5fe2ad2da91ec2b69c22532ff8ee33a8f
Instruction Fuzzy Hash: CF51CB30B201158FFF64A66CD96472F366BDB9A350F20453EED0ADB3D5CA68CD418B92

Function 062C91E6 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3a846c95bcee0c368cc81bff70ee53ed045cd31a6221abad4b7e2d8f6fb205
Instruction ID: 7bd899c05d6a5688baee22a9a8aa5f16331ac7d85dd6f4e4e8f717499cc4607c
Opcode Fuzzy Hash: 2d3a846c95bcee0c368cc81bff70ee53ed045cd31a6221abad4b7e2d8f6fb205
Instruction Fuzzy Hash: 97512030B111468FDB95DB78D890BAE73F6FF89350F148569D809AB348EE319C428B91

Function 062C4BF8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca6b8e6d7363542977c2ad32895cd0000371c6bba6b982d168a9c32b03c4e50
Instruction ID: 416030d90a7017420b9dff4f21c3827c7fe2c27ed5d4d7b9f18c056e85c6a1ae
Opcode Fuzzy Hash: 4ca6b8e6d7363542977c2ad32895cd0000371c6bba6b982d168a9c32b03c4e50
Instruction Fuzzy Hash: B7518230F102589FDB54EBA5C854BAEBBF6FF88300F208529E506AB395DB719D018B91

Function 062C5630 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c8e828ec5ac5d18f1d4600a006165ee404510e0a26c69a5439fde9ce64eb2f
Instruction ID: cdaa74e543e889e0e9b539bb200f729f8494a8f3c55743c3cfa614d05f1c32c3
Opcode Fuzzy Hash: 91c8e828ec5ac5d18f1d4600a006165ee404510e0a26c69a5439fde9ce64eb2f
Instruction Fuzzy Hash: 93416374E205178BDB648B68C480B7EB7B5FB45320F248A2AE815EB241C734E8A1DB91

Function 062C54B0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be245a01feca9e55a704bfa71901992c7a1cb44ede4a0e4c2a1e59291e0d89a
Instruction ID: c0209c08c2babbefc2e0b7d18fa4fab033737aa278d89f6049eab484e6519832
Opcode Fuzzy Hash: 0be245a01feca9e55a704bfa71901992c7a1cb44ede4a0e4c2a1e59291e0d89a
Instruction Fuzzy Hash: C1415F71E206068FDF70CFA9D8806AFF7B2EB85220F104A2ED556E7650D330F9658B91

Function 062CDB4D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cde57a8a4d5081d98811b07bd08b6efa6df11075cabfaa5e822f827676cb18
Instruction ID: 7480fceba13937bb29f5a9a132037145b73d97ba4fcc5b7dfff62926551e3824
Opcode Fuzzy Hash: 38cde57a8a4d5081d98811b07bd08b6efa6df11075cabfaa5e822f827676cb18
Instruction Fuzzy Hash: 2F417431E2064A9FDB55DF75D8547AEBBB2EF85310F108A2ED805EB240DB709945CB90

Function 062C2295 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49428e78b1713d245c25f6562b459722c4a8adaa1e4b24d5641e1d003172333
Instruction ID: 43438ca41e1288e104a0e6acacfe5271e05ebc98e70780a3c8f8a65138c80424
Opcode Fuzzy Hash: b49428e78b1713d245c25f6562b459722c4a8adaa1e4b24d5641e1d003172333
Instruction Fuzzy Hash: BD31F030B11202CFDB44AB75D8502AE7BB2BF89210B14896DC806EB385EF35CD02C791

Function 062C22A8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9a95f690c78da7ba2e263fddb98a0d6130d8a0b83c10b425ced0465727fbbf
Instruction ID: 48bd3cf24c2fe903b81436f1358fd90dcac3b66561c3773dc4cdb2fe0678ad67
Opcode Fuzzy Hash: 4f9a95f690c78da7ba2e263fddb98a0d6130d8a0b83c10b425ced0465727fbbf
Instruction Fuzzy Hash: 8C31D030B11206CFDB44AB75D4646AE7BA7BF89610F50492DD806EB385EF35CD02CB91

Function 062C2158 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f812067d5b2043d59f09d79ec1159108905308f8ec1848eb797e7ba30dfb7a7f
Instruction ID: 2dc962a6ce2c0b110c4dfc49e6ebafe7e8fa9409b8af1de06641dc975468528a
Opcode Fuzzy Hash: f812067d5b2043d59f09d79ec1159108905308f8ec1848eb797e7ba30dfb7a7f
Instruction Fuzzy Hash: 16316E30E21216DBCB55DFA4D89469EB7B2BF89310F10851DE916E7740DF719A42CB50

Function 062C2168 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951ef4ed101c9eb9380aa96f288df9dd8248111f5dad99029d564d941cb864af
Instruction ID: 9930692bae6b6df7ff3a323dfeec2a2ff756daa10a20820faddfacbc3f7b2237
Opcode Fuzzy Hash: 951ef4ed101c9eb9380aa96f288df9dd8248111f5dad99029d564d941cb864af
Instruction Fuzzy Hash: 86315030E21616DBCB55CFA8D85469EB7B2FF89310F10851DE916E7741DB71AD41CB40

Function 062C3B38 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c514b535547229e24f065ce89f9c0d3965b68ad46cad05cf004ead62959e61ca
Instruction ID: 537be0b6ccc737e5ca260f3e983c04f2f2bb890191bcc3b4252b2d7c7717e347
Opcode Fuzzy Hash: c514b535547229e24f065ce89f9c0d3965b68ad46cad05cf004ead62959e61ca
Instruction Fuzzy Hash: 6E218E75F112159FDB90DFA8E880AEEBBF1EB48710F148529E906E7390E731D9428B90

Function 062C3B48 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357dc8cd7c477803c232043774a6f9bebcfd0118e1fd09564a46b2685733aca9
Instruction ID: f48afd789602e812e2e6571d8bc2df1e186352094c87e4f904fb7d02bd243af0
Opcode Fuzzy Hash: 357dc8cd7c477803c232043774a6f9bebcfd0118e1fd09564a46b2685733aca9
Instruction Fuzzy Hash: A2219275F116159FDB40DFA9E880AADB7F1EB48710F108529E905E7380E731DD418B90

Function 062C3C58 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9ee913760d099bb808137b33b734b136f441aefc426dbbbd5e2dc0f237e9ce
Instruction ID: 9b42f9845e3b4e077ca8dc3c257ae67fb5ae3be87060a1f963cdc8eb45b8e809
Opcode Fuzzy Hash: 5e9ee913760d099bb808137b33b734b136f441aefc426dbbbd5e2dc0f237e9ce
Instruction Fuzzy Hash: 1F11E131B201264BDB54D668D8146AEB3EBEBC9360F008939C806E7344EE34CC028BD0

Function 062C4298 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bb9016e88daba1c1db85696b4ae4d12312775e72b5e25e99ec0a1bf68109e8
Instruction ID: 36374664bba0f757e9cb09211eb31e01278bdd30a18bb258471cc5a286666c1e
Opcode Fuzzy Hash: b0bb9016e88daba1c1db85696b4ae4d12312775e72b5e25e99ec0a1bf68109e8
Instruction Fuzzy Hash: 44012831B101120FDB71A6BDE42576BB7D6DBC9720F24893EE90AC7745E961CC018791

Function 062C3910 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7241cb7eecc1458907e6c7d906bafe98a40fde7523baf9551eac79351314ba0e
Instruction ID: b61fa96735fdedf0fa0f29a194e5ce61389a3bb5e48cff2a629045eaca1e24c5
Opcode Fuzzy Hash: 7241cb7eecc1458907e6c7d906bafe98a40fde7523baf9551eac79351314ba0e
Instruction Fuzzy Hash: 1821E3B1C01259AFCB10CF9AD884ADEFBB4BB48310F10811AE918A7200C3746544CBA5

Function 062CA3A9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d5a301d8eac8bf3622e2553c7289108942b57d95182a26e51eea4552792316
Instruction ID: 36b5879ae874aa379e5093c48cb9d6407372b7bf6bb488a9b947860c71917b87
Opcode Fuzzy Hash: b1d5a301d8eac8bf3622e2553c7289108942b57d95182a26e51eea4552792316
Instruction Fuzzy Hash: FA01DB71B202154FD7A1DA78E96476A77E5EBCA720F14893DE50AC7381EE21DC038791

Function 062C3C48 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9581870bcac192d789b5efbea385100d609435cd2910eecf661d56dca9b48277
Instruction ID: 13f151fc0c1cd1c7563ecb93826b1dda1be1e426c801a5e4eb3079e5b3fce071
Opcode Fuzzy Hash: 9581870bcac192d789b5efbea385100d609435cd2910eecf661d56dca9b48277
Instruction Fuzzy Hash: E401F736B201254BDB94D578DC157EFB7EBEBC9260F014939D906E7284EE64CD0247D2

Function 062CEE21 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007768be288b9c440a6e1ff8bf716e1204612d6fd2fb12e8f7437b6e8dddffd9
Instruction ID: ce082f8a9208e161fa7d41e39cc415ecdefc10167636a1cf2ee226587a9bcbf5
Opcode Fuzzy Hash: 007768be288b9c440a6e1ff8bf716e1204612d6fd2fb12e8f7437b6e8dddffd9
Instruction Fuzzy Hash: AB01A231B201114BDB75AA7CA850B2F77E6EBC9770F15893EE50ACB340EA25DC024795

Function 062C3918 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb295a48a4570095f4caa578d30cc82ba6390fd5d5531924820f8eb668f2931
Instruction ID: d6e7c707382b642b7e2a6e8b20eaf9b3fca96eee35b33ec45656a0ed10f9eda0
Opcode Fuzzy Hash: 2cb295a48a4570095f4caa578d30cc82ba6390fd5d5531924820f8eb668f2931
Instruction Fuzzy Hash: 7511C2B1D01259EFCB00CF9AD884ADEFBB4FB48310F10862AE918A7300C375A554CBA5

Function 062C42A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f787c8a434f48433570b7a378f4a29c380ce6250f0e0aafbcf9b085ad8169de5
Instruction ID: b00230efe496afedab61b8e696a144abd5581a15f28be3e4010422e5a37ea8a5
Opcode Fuzzy Hash: f787c8a434f48433570b7a378f4a29c380ce6250f0e0aafbcf9b085ad8169de5
Instruction Fuzzy Hash: D401D130B100220BEB71A6BDA42476FB2DADBC9720F24893EE90AC7744EA61DC024791

Function 062CEE30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff896cc08aace9afd97ae830116e4d8e0ffd667447728049fdd2815b43a70f0
Instruction ID: 12616f2f4c4e4abe9f84809171cca201c22a2abd7282a8efb0513ff5816421e9
Opcode Fuzzy Hash: bff896cc08aace9afd97ae830116e4d8e0ffd667447728049fdd2815b43a70f0
Instruction Fuzzy Hash: 2701AF31B201124BDBA5A67CA45472F76D6DBC9770F11893EEA0ECB340EE21DC024791

Function 062CA3B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5958920e9241bcb415bca7eb341a8bf147cf76be85cc0034470dc4aad16814ba
Instruction ID: 129f7a6d94c9b565bb751725a1dd936bfc1325476f14ea6cd9811128eca510fc
Opcode Fuzzy Hash: 5958920e9241bcb415bca7eb341a8bf147cf76be85cc0034470dc4aad16814ba
Instruction Fuzzy Hash: 97014431B101154FDB61EA7CE46476B73D6EB89720F50893DE50AD7384EE22DC428790

Function 062CC870 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26eb467ee0a21cd0d4521eae4137937d722e73fd73ea87037a5dfc043b4526a
Instruction ID: 44bda7b067b5175eff4482f8af8adc38585875270308fff4638530a1c34bc377
Opcode Fuzzy Hash: a26eb467ee0a21cd0d4521eae4137937d722e73fd73ea87037a5dfc043b4526a
Instruction Fuzzy Hash: D901F931F201149BDB54AA79E840A9E7775F785310F00423EED05EB344DB31980487C0

Function 062C8370 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea038fa8dbc27ce0f56917677758a7baae586c2f5fcbcf770764bbe9128fe260
Instruction ID: 9cf65654886ea9750ebfbf8f9eb97c7f184c91f197ce65b1080fb9f0a377b5b5
Opcode Fuzzy Hash: ea038fa8dbc27ce0f56917677758a7baae586c2f5fcbcf770764bbe9128fe260
Instruction Fuzzy Hash: 9DF0F432A34206CFDF649A54E9802ED7FA4EB41320F10926EDD04DB241DA7AD901C780

Function 062C6511 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2208807270.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62c0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034b141f07c7db9e93d057a0369f9b8deefb10e70d68a2a36daf5ed116742cd8
Instruction ID: 80c7e441064d4e82c90313981280fd8d8a13862acd9b63c103ef9e2b1658d7f2
Opcode Fuzzy Hash: 034b141f07c7db9e93d057a0369f9b8deefb10e70d68a2a36daf5ed116742cd8
Instruction Fuzzy Hash: DDE026B2E34209ABDB50CEB0C94571F7BEDDB42264F3089BADC08D7202E136CD028740

Analysis Process: qHqJcuLw.exePID: 1320, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	243
Total number of Limit Nodes:	8

Executed Functions

Function 0160D070 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0160D0FE
GetCurrentThread.KERNEL32 ref: 0160D13B
GetCurrentProcess.KERNEL32 ref: 0160D178
GetCurrentThreadId.KERNEL32 ref: 0160D1D1

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1fbbc2720a3802b254bc4b14ebe55ef6ba2f7fc830ce03c85edfe460541a2f81
Instruction ID: 870b6affc5938f5a6912e4556c262ae7d192f4058b73fe477f5c900ddbd5b1f8
Opcode Fuzzy Hash: 1fbbc2720a3802b254bc4b14ebe55ef6ba2f7fc830ce03c85edfe460541a2f81
Instruction Fuzzy Hash: E15167B0900749DFEB09DFA9D948BDEBBF1BF48304F208459D008A73A0D7749884CB65

Function 0160D080 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0160D0FE
GetCurrentThread.KERNEL32 ref: 0160D13B
GetCurrentProcess.KERNEL32 ref: 0160D178
GetCurrentThreadId.KERNEL32 ref: 0160D1D1

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2010af9ca0a70a4b47b0802f551c8bb3d00571cd9a33353b2443281528abcec8
Instruction ID: d745bf2e8edc07fc845c046a75b703e6cfbd39701f446d0393eca4f4ff8ef559
Opcode Fuzzy Hash: 2010af9ca0a70a4b47b0802f551c8bb3d00571cd9a33353b2443281528abcec8
Instruction Fuzzy Hash: F95166B0900709DFEB08DFA9D948B9EBBF1FF88314F208459E009A73A0DB745884CB65

Function 07694A5C Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07694C9E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: af86dd8f1089050aae39db965b898ef43e3ee9ae81626bf11133589b57cba048
Instruction ID: e220aea8344287ae08403f30aaf2a7eca94a23f9d2f19a73a5b170e70e93ed3f
Opcode Fuzzy Hash: af86dd8f1089050aae39db965b898ef43e3ee9ae81626bf11133589b57cba048
Instruction Fuzzy Hash: C7916CB1D0165ACFEF24CFA8C8417DEBBB6BF48314F0481A9D809A7254DB749986CF91

Function 07694A68 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07694C9E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5f36c4a6e42e61f4be1a33129232366a5a9bfea5c91152062f7ae6d8b5a3027b
Instruction ID: 0873b72e54cdf3055a46e9e9fbbc502030b223c9c369dddb90a62f53a414e0ff
Opcode Fuzzy Hash: 5f36c4a6e42e61f4be1a33129232366a5a9bfea5c91152062f7ae6d8b5a3027b
Instruction Fuzzy Hash: 62916DB1D0065ACFEF24DFA8C8417DEBBB6BF48314F0481A9D809A7244DB749986CF91

Function 0160ADE8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0160B03E

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 35c1c0eb5f48ad1e3d6e42c2a8657c64dfe7d48372ddaf17500ac9b8cad296ff
Instruction ID: 05c334adf02e37b3baac124092f165b5e4a808eb82643df6bd602a7fb12bcc85
Opcode Fuzzy Hash: 35c1c0eb5f48ad1e3d6e42c2a8657c64dfe7d48372ddaf17500ac9b8cad296ff
Instruction Fuzzy Hash: 9C714470A00B068FE729DF69D84475BBBF1BF88240F008A2DD58AD7B80D735E845CB94

Function 0160590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016059C9

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 47736cf8cead89946fb79a88c52d1083209f41096ee5bcc59435dfc38de150e8
Instruction ID: be73cacb0d432287de8bb797f43b7f54d2c34222914396af977a8f7cc4b3ad44
Opcode Fuzzy Hash: 47736cf8cead89946fb79a88c52d1083209f41096ee5bcc59435dfc38de150e8
Instruction Fuzzy Hash: 0141EF70C00719CFEB24CFA9C885BDEBBB1BF89704F20815AD409AB255DB756986CF90

Function 016044B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016059C9

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 52f9bd16346c7b960ed75907fdffd1aaf917e0eb334e78728cb257599876b9e2
Instruction ID: 6f0b7f155c893a1d6202a046e6c8c9fa5976fe1e3a7c7efd07f3622677f212f3
Opcode Fuzzy Hash: 52f9bd16346c7b960ed75907fdffd1aaf917e0eb334e78728cb257599876b9e2
Instruction Fuzzy Hash: A941D070C0071DCBEB24DFA9C884BCEBBB5BF49704F20816AD409AB255DB756985CF90

Function 076947D8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07694870

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 665e478587842a707c92e86669ecc69263c9a7a7b4dc48f09cfe34e3aafd9ffc
Instruction ID: d806607719382e5d16a28ed821d39a5cf6a7ddfecda74cb5ec8663364d505232
Opcode Fuzzy Hash: 665e478587842a707c92e86669ecc69263c9a7a7b4dc48f09cfe34e3aafd9ffc
Instruction Fuzzy Hash: 952122B19003499FDF10CFA9C981BEEBBF5BF48310F10842AE919A7340C7789A51CBA4

Function 076947E0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07694870

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bbfaa6618dfb6a27738dc746198225a16591789acb88afdf107c5c98e0f1f8d5
Instruction ID: 416bbd352f054f6f9707a1746b1b1934cd5f3c3318099611548b960605106202
Opcode Fuzzy Hash: bbfaa6618dfb6a27738dc746198225a16591789acb88afdf107c5c98e0f1f8d5
Instruction Fuzzy Hash: 552113B19003599FDF10CFAAC981BEEBBF5BF48310F10842AE919A7340C7789955CBA4

Function 0769420A Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0769428E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5e3a2938a6c7cfde1aea6809ea8acef22b4b194a545db4ad4fbbc2890ed0a764
Instruction ID: 8cfee7a76f573a7eb3bc0b4884fe9933a84a19ecec2953fb09ef9fccb15c55c0
Opcode Fuzzy Hash: 5e3a2938a6c7cfde1aea6809ea8acef22b4b194a545db4ad4fbbc2890ed0a764
Instruction Fuzzy Hash: 8F2125B19003499FDB10DFAAC9857EEBBF4BF88314F14842AD559A7340CB789A45CFA4

Function 076948C9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07694950

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6c43eb21543535e4ca2c663fdc23a92e21d3e8d9e419896591bb1359c5f5022d
Instruction ID: 9c4f845f32fd0a41621047093bfd36c85d465bfc7ec9d117758bd7abbb6437f4
Opcode Fuzzy Hash: 6c43eb21543535e4ca2c663fdc23a92e21d3e8d9e419896591bb1359c5f5022d
Instruction Fuzzy Hash: 3E2105B18003499FDF10DFAAC881AEEBBF5FF48310F10842AE959A7250C7799951CBA5

Function 07694210 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0769428E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0664e5bd5b5e6b187e859d3ca9f8e7f8f574616c0856b1531b88a0f0c112583a
Instruction ID: 8ed3f7543a06a88023f2b9ba7c7e3e240b8642e28d489a5aaa91f83e15ec4438
Opcode Fuzzy Hash: 0664e5bd5b5e6b187e859d3ca9f8e7f8f574616c0856b1531b88a0f0c112583a
Instruction Fuzzy Hash: BC2135B19003499FEB10CFAAC4857EEBBF4BF88324F14842AD519A7340CB789945CFA5

Function 076948D0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07694950

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a905a59ee62e1cc83f5079821087d28313cb0138d45462636fdba1fa9f1f2c04
Instruction ID: 97e1e5fc8d236825920c1bcb4aa961c636c55b0014f724e0abad1379092dbc5b
Opcode Fuzzy Hash: a905a59ee62e1cc83f5079821087d28313cb0138d45462636fdba1fa9f1f2c04
Instruction Fuzzy Hash: C72116B18003499FDF10CFAAC881ADEBBF5FF48310F108429E559A7240C7799900CBA5

Function 0160D6C8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0160D757

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3efc351fab189c8cd1347f258ea7546e819c40197b38c99a299d589f7fef29b9
Instruction ID: f96ffdd5cf6ed7eb3f2b650a9e1beb48862c71b146be44f440dbccee348c9ace
Opcode Fuzzy Hash: 3efc351fab189c8cd1347f258ea7546e819c40197b38c99a299d589f7fef29b9
Instruction Fuzzy Hash: D221E3B5900249DFDB10CFA9D985AEEBBF4EF48310F14841AE918B7350D378A954CF65

Function 0160D6D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0160D757

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f27002331cb568ee89ff27184da786e65cc609334b44600804d036ffee278ffc
Instruction ID: e14254913154429559cead951c4614d1071246f4b11987002c19da5141621dd2
Opcode Fuzzy Hash: f27002331cb568ee89ff27184da786e65cc609334b44600804d036ffee278ffc
Instruction Fuzzy Hash: 7C21E3B5900248DFDB10CFAAD984ADEBBF8EB48310F14801AE918A3350D378A954CFA5

Function 0160A170 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0160B0B9,00000800,00000000,00000000), ref: 0160B2CA

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 69ebf3bb3f7b2164fe019d7a26a447eea42c0e58e00e7830dce00cd8233e7bd7
Instruction ID: 35e5948df2bdc55374315ed38576998f6313723f897602ebf4feda61b8cc4d8f
Opcode Fuzzy Hash: 69ebf3bb3f7b2164fe019d7a26a447eea42c0e58e00e7830dce00cd8233e7bd7
Instruction Fuzzy Hash: 5F11E4B6904349DFDB14CF9AC844AAFFBF4EB88310F10852AE519A7340C375A545CFA5

Function 0769471A Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0769478E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 490e913add44fe97ef7df0c2767f876007dd95419fd8b9ad9e636cafbc214430
Instruction ID: 6156bc7eb41c490ab0fd6a2b87247f71b52bd4427726824f753d99a908e4c6c3
Opcode Fuzzy Hash: 490e913add44fe97ef7df0c2767f876007dd95419fd8b9ad9e636cafbc214430
Instruction Fuzzy Hash: 4A114475800249DFDF10DFAAD845BEEBBF5AF88320F148819E515A7250CB7A9510CFA0

Function 07694720 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0769478E

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 91c0474ad27d126068f6bb74ae911e9bdb52b2a7dbcea17b1ca89610973135af
Instruction ID: 77055b55334d670c4a42f50c6519a352e5f4eee110eca588ca6286fac14f41ff
Opcode Fuzzy Hash: 91c0474ad27d126068f6bb74ae911e9bdb52b2a7dbcea17b1ca89610973135af
Instruction Fuzzy Hash: 56115671800349DFDF10CFAAC845BDFBBF5AF88320F108819E515A7250CB769500CBA4

Function 0160B258 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0160B0B9,00000800,00000000,00000000), ref: 0160B2CA

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c5bf002730c08891b84fc01e89cdc917c676f5e08694ce02c707e4273931288c
Instruction ID: df13cea79155d62a98917927cbefb791928188f5244c3e640cf8f5c2d38dfa6c
Opcode Fuzzy Hash: c5bf002730c08891b84fc01e89cdc917c676f5e08694ce02c707e4273931288c
Instruction Fuzzy Hash: CC11E4B6800249DFDB14CFAAC845ADEFBF4EB88310F14852AD519A7350C375A545CFA5

Function 0769415A Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 076941C2

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 82d8d361cf3ae1dc43b7aa1c599c7d22fe5b7262a8706eac11b8ee04c12079c1
Instruction ID: 5c2a734a560fa628d21288c066aa50437e3ff483a3d9293abff48cab5dc2cb5a
Opcode Fuzzy Hash: 82d8d361cf3ae1dc43b7aa1c599c7d22fe5b7262a8706eac11b8ee04c12079c1
Instruction Fuzzy Hash: 2F1113B1900349CFDB20DFAAC9457AEBBF5AF88610F24882AD519A7340CB799544CBA5

Function 07694160 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 076941C2

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 73e92aedc32d4407e04660a99a8d580a050aeb7cffeb31487b92d66fa8c353fb
Instruction ID: a4a658805d5317ca090a9e5b157b73ff0a2bfe89bd7a36ff02b15bc67eba6aa0
Opcode Fuzzy Hash: 73e92aedc32d4407e04660a99a8d580a050aeb7cffeb31487b92d66fa8c353fb
Instruction Fuzzy Hash: C91128B1900349CFDB10DFAAC8457AFFBF8AF88610F24842AD519A7240CB79A544CBA5

Function 076984C1 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07698525

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f6bf8739db8436bbdc335b0ae9acafff77ef16445dc78d64a80516357c19bfae
Instruction ID: e132880e1a450a924a8148f33be5c8bcdedf9a89420638c1e39964ed5563a85a
Opcode Fuzzy Hash: f6bf8739db8436bbdc335b0ae9acafff77ef16445dc78d64a80516357c19bfae
Instruction Fuzzy Hash: 0711F2B5800349EFDB10DF9AD845BDEBBF8EB48320F20845AE519A7700C379A944CFA5

Function 07697E44 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07698525

Memory Dump Source

Source File: 0000000C.00000002.2227017943.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7690000_qHqJcuLw.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ff598262fd61ecb2a168714048befe0d95dcde2a620038c3a9d4a54d4f787a5b
Instruction ID: 6db5b96c9cbe95ad042b892c535911caa4229e0e0dc1313b512bb2345afe42f7
Opcode Fuzzy Hash: ff598262fd61ecb2a168714048befe0d95dcde2a620038c3a9d4a54d4f787a5b
Instruction Fuzzy Hash: 6F11F2B5800749DFDB20DF9AD845BDEBBF8EB49310F10845AE519A7300C379A948CFA5

Function 0160AFD8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0160B03E

Memory Dump Source

Source File: 0000000C.00000002.2221322857.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1600000_qHqJcuLw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 16054f45279e4e646555e066c2f1cdda1cdafeb696b7309d717f448203a8e28b
Instruction ID: aa03fec0149b698e8d69c4b796b5d3e13e35ed2edbfb86b7dbba2e21e24a68c2
Opcode Fuzzy Hash: 16054f45279e4e646555e066c2f1cdda1cdafeb696b7309d717f448203a8e28b
Instruction Fuzzy Hash: 8A11FDB68006498FDB14CF9AC844A9FFBF4AB88210F10841AD529A7340D379A545CFA5

Function 0567B2D0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0567D085

Memory Dump Source

Source File: 0000000C.00000002.2225811675.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5670000_qHqJcuLw.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4f1df969a5b994291bec8e724573e98c59ff6456117fa6cd133a0f99db873d09
Instruction ID: 55519bb93661a0e95319e0fecf2b8111b818c9982d7ef979d065d1a4a30208fe
Opcode Fuzzy Hash: 4f1df969a5b994291bec8e724573e98c59ff6456117fa6cd133a0f99db873d09
Instruction Fuzzy Hash: A11103B5804748CFDB20DFAAD445B9EBFF4EB48220F108459D559A7300C379A944CFA5

Function 0567D029 Relevance: 1.5, APIs: 1, Instructions: 42comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0567D085

Memory Dump Source

Source File: 0000000C.00000002.2225811675.0000000005670000.00000040.00000800.00020000.00000000.sdmp, Offset: 05670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5670000_qHqJcuLw.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 31c8da31d6c116d51a93ec4eee5e35f463403d8f6e5b356cd54881c24c03030e
Instruction ID: f94a65565c2df7fffe2baf4e35e7f14243caf3b98e51918175f441937f84b8b5
Opcode Fuzzy Hash: 31c8da31d6c116d51a93ec4eee5e35f463403d8f6e5b356cd54881c24c03030e
Instruction Fuzzy Hash: C9110DB5800249CFDB20CFAAC589B9EFBF4AF48224F20881AD558A7700C379A544CFA5

Function 0157D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14613768d4891bb52678b90badb16e7b41a5ca45b4d70d121fbb54f5d6766628
Instruction ID: efdb02e465d291410102980e67bf8822e49e44fb99bd913914cd814b66c6cb4a
Opcode Fuzzy Hash: 14613768d4891bb52678b90badb16e7b41a5ca45b4d70d121fbb54f5d6766628
Instruction Fuzzy Hash: EF21E072604200EFDB059F94E9C1B2ABBB5FF88324F248569E9090E246C336D857CAA1

Function 0157D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7864a8f1b57bc51cb0ac0bddcd12ecd0009877addfa7d223e118b99dff21bb5f
Instruction ID: 51884708402bf37d140f103b4eae594c4b180f5eb69eead2b6f7b1fb7ee0b3ae
Opcode Fuzzy Hash: 7864a8f1b57bc51cb0ac0bddcd12ecd0009877addfa7d223e118b99dff21bb5f
Instruction Fuzzy Hash: 8D210372500240EFDB05DF58E9C1B2ABFB6FF88318F24C569E9090F256C336D456CAA2

Function 0158D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220847353.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_158d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4d6368421f0f5e2e458524cfd29780bae45fe4ee85ecf1d280ab322ce9b7e7
Instruction ID: eecd30c74ed144294a3542e57db86ac6a234a68a311a5cab4c2864b2c8ed67c1
Opcode Fuzzy Hash: eb4d6368421f0f5e2e458524cfd29780bae45fe4ee85ecf1d280ab322ce9b7e7
Instruction Fuzzy Hash: DB210371604204EFDB15EF64D980B26BBF1FB84314F20C96DD9095F282D33AD447CA61

Function 0158D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220847353.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_158d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4e48e921c0bbf3e9ad50e27cc7182e410b2cdf634bee4269798815d973d01a
Instruction ID: 9d51211332e37e462bd6bc23c3db2ca455c59b829c74627186a24bd1e9431c92
Opcode Fuzzy Hash: dc4e48e921c0bbf3e9ad50e27cc7182e410b2cdf634bee4269798815d973d01a
Instruction Fuzzy Hash: 5E21C571604204EFDB05EF94D5C0B25BBF5FB84324F24C96DD94A5F292C37AD846CA61

Function 0158D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220847353.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_158d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81da78614c59f330b60ccf14f4ace49fbc0832e9002b7433debd805aab998cee
Instruction ID: 135c3549529cc6c2dccf504e5119197a50c2df697211eacb801e8b9758598259
Opcode Fuzzy Hash: 81da78614c59f330b60ccf14f4ace49fbc0832e9002b7433debd805aab998cee
Instruction Fuzzy Hash: 61217C75509384DFDB02DF64D990715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0157D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction ID: d4b5257f15070909f70ae285c130ae2e49f6947a2f98b8eeecd3a95de512a612
Opcode Fuzzy Hash: 8a958cd7c859b04241e3965f2995fa9ff46dd324e9e88069bdc96e2e9819e0d2
Instruction Fuzzy Hash: F4218C76504244DFDB06CF54D9C4B1ABF72FB84224F2485A9DD090A656C33AD42ACBA2

Function 0157D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction ID: a97dec8e77a154bf342fb7db16009cd0bc3f0e7864e950a82d6be621032f9766
Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
Instruction Fuzzy Hash: 05119D76504280DFCB16CF54D5C5B1ABF71FB84224F2486A9D8490F656C33AD45ACBA2

Function 0158D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220847353.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_158d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction ID: 9cea35513eece823e17f83d295d6f12e7f1329261889998c84819c7b067a65fc
Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
Instruction Fuzzy Hash: 7511A975904284DFCB02DF54C5C0B19BBB1FB84224F24C6A9D84A4F296C33AD40ACB62

Function 0157D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba870901ff38b93ed40828c86e05eb4bb9268db4db561926dc373180124dfb68
Instruction ID: ac8f4b7a80251ea643e02b05ce8eeff030fcf2e4ee136027c8109023e23fe28d
Opcode Fuzzy Hash: ba870901ff38b93ed40828c86e05eb4bb9268db4db561926dc373180124dfb68
Instruction Fuzzy Hash: 4A01F731005380DAE7104E69ED85B6AFFF8FF81220F04891AEE090E286C6799840C6B1

Function 0157D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2220601075.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_157d000_qHqJcuLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfdf25143674afd0c71b2f81c200cdb291877ea7d41b84be35b3c39e80b460c
Instruction ID: 7f6d186cad796f2c10fe57c76cb80501258757d285a94631847c26b4d0daf798
Opcode Fuzzy Hash: ecfdf25143674afd0c71b2f81c200cdb291877ea7d41b84be35b3c39e80b460c
Instruction Fuzzy Hash: CEF06D72405384AEE7118E1AD988B66FFA8EF81634F18C55AED084E287C2799844CAB1

Analysis Process: RegSvcs.exePID: 7056, Parent PID: 1320COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	153
Total number of Limit Nodes:	17

Executed Functions

Function 063A5640 Relevance: 1.8, Strings: 1, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 063A5CBC

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e13837431f38a43eb902a7698ff8be9d8db51924c3c15b62c349fe7b3de7d220
Instruction ID: 023815a986c2495410c4ee513d1585ab841a1e0a16948166aa403b3d802ac935
Opcode Fuzzy Hash: e13837431f38a43eb902a7698ff8be9d8db51924c3c15b62c349fe7b3de7d220
Instruction Fuzzy Hash: 9022BE75F002158FDB64DBA4C4806AEBBB6EF89320F24856AE845EB345DB31DC46DBD0

Function 063A2420 Relevance: 1.0, Instructions: 991COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4b8ab1075ea91a58ea539b8a7b8f0186cefe0f07a5a4fe86e6ddc5109963c2
Instruction ID: b0782a7f8a0354393adacc84fc38ffb824abca0e16a16d265b75d6c4d45bde8d
Opcode Fuzzy Hash: 2f4b8ab1075ea91a58ea539b8a7b8f0186cefe0f07a5a4fe86e6ddc5109963c2
Instruction Fuzzy Hash: 59924734E003048FDB64DF68C584A5EB7F2EB49314F5885A9D40AEB3A1DB75ED89DB80

Function 063A6690 Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753d617f5c5a31feb797f14c9ca479729c4f3295a7c210387f48c13d838fd096
Instruction ID: a63c78be879a35f860246d58f122e46ceb9b146a7780385dc4e337c7eec563c1
Opcode Fuzzy Hash: 753d617f5c5a31feb797f14c9ca479729c4f3295a7c210387f48c13d838fd096
Instruction Fuzzy Hash: C462BC34B002048FDB54DB68D594AAEB7F6EF8A300F288469E406DB391DB35ED46DBD0

Function 063ACFD8 Relevance: .8, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a681d5b02b5b6305218c361c535f97deb8b3c606d5dbd7b2112fd77dd4ee1d98
Instruction ID: a4d51da1fe52bcefb3295daa02d20567e4a556cbe130c63cb678b6c5064f69b1
Opcode Fuzzy Hash: a681d5b02b5b6305218c361c535f97deb8b3c606d5dbd7b2112fd77dd4ee1d98
Instruction Fuzzy Hash: CF622F30B012068FDB55EB68E590A9EB7B2FF85700F208629D0059F759DB75ED4ACBD0

Function 063AC228 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a7d670df30974dbce2becf55aa2ab1c362737e2ec21d7272ddacb8ba0be160
Instruction ID: 4825ef28a9ca7b3be0f6259faa832e8185d3f4807cd458c537cf65868e3437df
Opcode Fuzzy Hash: 21a7d670df30974dbce2becf55aa2ab1c362737e2ec21d7272ddacb8ba0be160
Instruction Fuzzy Hash: 2D327E30B102058FDB64DB68D890BAEB7B6FB89310F209529E505EB395DB35EC46DBD0

Function 063AB2C8 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258e0db14429bce54b8587847e96696d1a629631b03168d44b30b4931223edbc
Instruction ID: 0ad7ef08d897da08a7ea9df4835c00006846d7290fd6e673b5fb0d15b43228d4
Opcode Fuzzy Hash: 258e0db14429bce54b8587847e96696d1a629631b03168d44b30b4931223edbc
Instruction Fuzzy Hash: 6B224F30E102098BEFA4DB68D5907ADF7B2FB49310F208929E446DB395DA35DC85EB91

Function 063A30F8 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b56388b849ae7aba77a5e79227a276cc08784787df820c8af24b2c0231e39f
Instruction ID: bdf7a2424f76a0e9cc4c8d4d8fb784ad5514787f2d141d878486104f7e270f64
Opcode Fuzzy Hash: 73b56388b849ae7aba77a5e79227a276cc08784787df820c8af24b2c0231e39f
Instruction Fuzzy Hash: 1A322031E1075ACFDB14EF74C8545ADB7B6FFC9300F6086AAD409A7254EB30A985CB91

Function 063A7E20 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642f4b69095a798789f0a33ca1dcbe569da545efeff7db6b4fb2e5afc38ace25
Instruction ID: ddb1c4a3f097c398fb80abfc3b4dda03dd0226429457ef683e0fdef30f925141
Opcode Fuzzy Hash: 642f4b69095a798789f0a33ca1dcbe569da545efeff7db6b4fb2e5afc38ace25
Instruction Fuzzy Hash: 32029D34B012169FDB54DB68D894AAEB7F6FF89300F248529E4059B395DB31EC46CBD0

Function 06392E07 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06392E86
GetCurrentThread.KERNEL32 ref: 06392EC3
GetCurrentProcess.KERNEL32 ref: 06392F00
GetCurrentThreadId.KERNEL32 ref: 06392F59

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aefd7226493a9e7ecc3c27641f247e7113250709f0205c47befda3ecd263f7b8
Instruction ID: 4690ade293e3d6a80a0b53e28463845bf529f91172d852736c76aa8b2cf8d1ee
Opcode Fuzzy Hash: aefd7226493a9e7ecc3c27641f247e7113250709f0205c47befda3ecd263f7b8
Instruction Fuzzy Hash: AB5143B4900709DFDB54DFAAD848BEEBBF1EB88304F208059E119A7290D7345944CBA5

Function 06392E08 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06392E86
GetCurrentThread.KERNEL32 ref: 06392EC3
GetCurrentProcess.KERNEL32 ref: 06392F00
GetCurrentThreadId.KERNEL32 ref: 06392F59

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5b21b87e145638d3b81c7c5a0923828ca3cd63acac8826e81fc3b12e26b3fbac
Instruction ID: fff085de72ad503a7fab561783eadcf42c6e2a07a8e0a91f0ca0e9b22e069dd2
Opcode Fuzzy Hash: 5b21b87e145638d3b81c7c5a0923828ca3cd63acac8826e81fc3b12e26b3fbac
Instruction Fuzzy Hash: B05143B4900709DFDB54DFAAD848BEEBBF1EB88304F208059E119A7290D7345944CBA5

Function 0639B318 Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0639B57E

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8916ea397a78b7447cc2947a54e4c340bb1343d079f4f74de2cda8b9829b5f13
Instruction ID: e4f70904354566dfce5a040407b99a6734a5a1364aaf97ff855e1562402beb1f
Opcode Fuzzy Hash: 8916ea397a78b7447cc2947a54e4c340bb1343d079f4f74de2cda8b9829b5f13
Instruction Fuzzy Hash: 2F811270A00B058FDBA4DF2AD44075BBBF1FB88204F04892DD49AD7A50E735E849CFA1

Function 00DDEC58 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.3361291909.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_dd0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ea7a13cb469884de92599fe30f2197fcb7d6726a54450864b152b5b12079f7
Instruction ID: 1140c653940c8f847ce4438deb5e4e736a16ab492e3eeccdfa63fd48bbf843b8
Opcode Fuzzy Hash: 40ea7a13cb469884de92599fe30f2197fcb7d6726a54450864b152b5b12079f7
Instruction Fuzzy Hash: D0412232D003998FDB14DF79D8102AABBF5EF89310F14856BD904AB341EB789945CBE0

Function 0639D504 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0639D622

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6ec82f3e39704bb8416d520c551b85293a9736a2d5ec904364198f828f0a93da
Instruction ID: 73c3a5a5868793cf0a3f561ce02bc1346448e9c209dc074f65e376fc50231d07
Opcode Fuzzy Hash: 6ec82f3e39704bb8416d520c551b85293a9736a2d5ec904364198f828f0a93da
Instruction Fuzzy Hash: 6551DFB1D00749AFDF14CFA9C884ADEBFB5BF48300F64812AE819AB210D775A845CF90

Function 0639D510 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0639D622

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c7d628c4df3339fd31b6802e79deef665a60f161d3d3bf6d8cfa72f005008451
Instruction ID: 285d36536150d2a2b0219903abc8a385c50f3dba8b927be3c0221536017363b3
Opcode Fuzzy Hash: c7d628c4df3339fd31b6802e79deef665a60f161d3d3bf6d8cfa72f005008451
Instruction Fuzzy Hash: EC41BEB1D00749DFDF14CFA9D884ADEBBB5BF48310F64852AE818AB210D7759845CF90

Function 0639E47C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0639FD11

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 75a63c05085eedec1bdd5cb666138e298297e03e41360b27af873a75da8e253e
Instruction ID: 47f1597c458c3a51c35f8e7760956472fa1dfa1ffcf10e573da6999684944f5d
Opcode Fuzzy Hash: 75a63c05085eedec1bdd5cb666138e298297e03e41360b27af873a75da8e253e
Instruction Fuzzy Hash: 524115B4A00309DFDB94CF99C448AAABBF5FF88314F24C859D519AB321D374A845CFA0

Function 06393048 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 063930D7

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 83c8947772747c10e3124fa8df3db33a55a108f90517206a2fc4e51718996df4
Instruction ID: ff32b5f2e39a50c5dbcfbf81f0ad0390d784e3c89f5e02ba09ed94a090735105
Opcode Fuzzy Hash: 83c8947772747c10e3124fa8df3db33a55a108f90517206a2fc4e51718996df4
Instruction Fuzzy Hash: 4421F4B5D00248EFDB10CFAAD884ADEBBF8EB48310F14841AE914A3350C378A954CFA5

Function 06393050 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 063930D7

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2e24aeeda6ed7a722ae05efff0c9b9583aa30a510f7f6fe4c2e6207c655a9686
Instruction ID: 03ade454300bb5a0ede7e6cc5bf08e343627b860c3ea9c5270e2715d0ca8c963
Opcode Fuzzy Hash: 2e24aeeda6ed7a722ae05efff0c9b9583aa30a510f7f6fe4c2e6207c655a9686
Instruction Fuzzy Hash: 2B21E6B5D00248DFDB10CFAAD884ADEFBF4EB48310F14841AE914A3350C379A944CFA5

Function 0639B77A Relevance: 1.6, APIs: 1, Instructions: 57
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0639B5F9,00000800,00000000,00000000), ref: 0639B7EA

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 37fb366ae8a9a647178f5c58da8a1a312d9866feef7077becee430980e4b886c
Instruction ID: ad7d7c3242a73a0485c908632469eb7b3258c4affe7185bcd5aeafcc51f97198
Opcode Fuzzy Hash: 37fb366ae8a9a647178f5c58da8a1a312d9866feef7077becee430980e4b886c
Instruction Fuzzy Hash: DA11D3B6C003499FDB14CFAAD844ADEFBF8AF48710F14842AE519A7250C379A545CFA5

Function 0639A310 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0639B5F9,00000800,00000000,00000000), ref: 0639B7EA

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fb5254ddd076e04467eb8cb077af10ffb564c41aa91a1a2541f62c5f04931441
Instruction ID: c48e9acca4d039f472df1a3c117459f782172bd86c836b0303de5466301689d9
Opcode Fuzzy Hash: fb5254ddd076e04467eb8cb077af10ffb564c41aa91a1a2541f62c5f04931441
Instruction Fuzzy Hash: EA1103B6D003499FDB10CFAAD844A9EFBF8AF48710F10852AD519A7200C379A545CFA5

Function 00DDED40 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00DDEDA7

Memory Dump Source

Source File: 0000000F.00000002.3361291909.0000000000DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_dd0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a3ffd2b2a697db55e35a9be41d53740e9f5d60a716efa356a6145c875f148e85
Instruction ID: 80367562b58aa52ff2f8a37f201d79552a16610074b00617e1f25d040fcf44a5
Opcode Fuzzy Hash: a3ffd2b2a697db55e35a9be41d53740e9f5d60a716efa356a6145c875f148e85
Instruction Fuzzy Hash: 4A110DB1C0065A9BDB10DFAAD444B9EFBF4AF48320F15812AD918A7340D778A944CFA5

Function 0639B518 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0639B57E

Memory Dump Source

Source File: 0000000F.00000002.3369495382.0000000006390000.00000040.00000800.00020000.00000000.sdmp, Offset: 06390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6390000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 48f8d44e187a97bd22ee49837651d6f2804ccf0d075b82ca135d73066219abea
Instruction ID: b678b74cf7bd7efa1660e842b7b189d685be27b1d1d58006deba779200e63dc3
Opcode Fuzzy Hash: 48f8d44e187a97bd22ee49837651d6f2804ccf0d075b82ca135d73066219abea
Instruction Fuzzy Hash: 50110FB5C00749CFDB10CF9AD444A9EFBF4AB88710F14841AD419A7210D379A549CFA5

Function 063AFD11 Relevance: 1.4, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3, xrefs: 063AFD14

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: c2101518e17a40b5c64c0574e51b6c0c67710c3022725efdb430c439df3987e5
Instruction ID: ac92449a767488a7966095c4d00fc5ea80119ab9ffaf8c6bff9a2af8ef497fa2
Opcode Fuzzy Hash: c2101518e17a40b5c64c0574e51b6c0c67710c3022725efdb430c439df3987e5
Instruction Fuzzy Hash: CC510131E01205DFDB64AB78E8846ADBBB2FF85311F20886DE106EB254DB358949DBD0

Function 063AB6E8 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb6cec46733f24c18e8ced3f25b6436996239d7f1cc316acbdc5e55fa01b650
Instruction ID: 5b7a6c66687bdf213ca5047b06b2cd77767a4a33ad5c2be26165cf1f58de90e7
Opcode Fuzzy Hash: 9bb6cec46733f24c18e8ced3f25b6436996239d7f1cc316acbdc5e55fa01b650
Instruction Fuzzy Hash: FD025A30E1020A8FEBA4DF68D490BADF7B6FB45310F20892AE416DB251DB75D849DBD1

Function 063AAD70 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a20aca5f611933f4aca209d6e513593bb68f53a4eb33d62381bca468fa851a5
Instruction ID: 441328e46995ce5abaaa04d278a3093cf7408becb5ba90d6e9f5cce337cc9b08
Opcode Fuzzy Hash: 7a20aca5f611933f4aca209d6e513593bb68f53a4eb33d62381bca468fa851a5
Instruction Fuzzy Hash: E7E15031E103068FDB69DF68D8906AEB7B6FF89300F20852AE506DB355DB319846DBD1

Function 063A91F0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bff016c521a3e7fc0420563441e6391844e360dcad1bcd733fc11f020dea272
Instruction ID: c3b23188fae094e843126164fbbb54796acb83cb7424f40fd4c5c612ef0f1b02
Opcode Fuzzy Hash: 5bff016c521a3e7fc0420563441e6391844e360dcad1bcd733fc11f020dea272
Instruction Fuzzy Hash: E4913130B1025A8FDB54DF68D890BAE77F6FFC5200F108569C809AB788EF319D469B90

Function 063A6290 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c28699fb46dce25fcee06fcdb30499172031824eed991a694aac9981f0c08e
Instruction ID: ce8b5087f7de78b26b3e9a18f4311522d1e339fc746e7961c94b8b9e0c5dd802
Opcode Fuzzy Hash: 20c28699fb46dce25fcee06fcdb30499172031824eed991a694aac9981f0c08e
Instruction Fuzzy Hash: 8F61D272F002214BDF509A7DD84466EBAD7EFD5220B194039D90EDB360DE65DC0287D1

Function 063A4338 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a829ee383248bb57e53eb80ec7016d109cdd7c6eaa2b3a64351097b0501098
Instruction ID: 7f7f259f8e6d5979724e582abe8265545d028c2147a60b6b5fba2acf7bb8aafe
Opcode Fuzzy Hash: 05a829ee383248bb57e53eb80ec7016d109cdd7c6eaa2b3a64351097b0501098
Instruction Fuzzy Hash: 9D816C30B012468FDB54DFA8D8507AEB7F6EF89300F208528D40AEB395EB75DC469B91

Function 063A4658 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f72462e3befddd090a99d4a5528524f43d27a6fc8e47c836bb17ce8fe0ab230
Instruction ID: e1f1d774e375d81017416cec140e4d25d47d4a85fc2a75700809c96928ba6396
Opcode Fuzzy Hash: 8f72462e3befddd090a99d4a5528524f43d27a6fc8e47c836bb17ce8fe0ab230
Instruction Fuzzy Hash: FB914C34E103598FDF60CF68C890B9DB7B1FF89310F208699D549AB256DB71AA85CF90

Function 063A4670 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4652da241eda298e9e906daed53334b90f930fb7ea952ec1724d0ae311903a
Instruction ID: 538f864770791f85b6ca30e6df4595ad4d2d454dc18c5285f31b36ca6da0f1cb
Opcode Fuzzy Hash: 6b4652da241eda298e9e906daed53334b90f930fb7ea952ec1724d0ae311903a
Instruction Fuzzy Hash: 51913C34E102198BDF60DF68C890B9DB7B1FF89310F208699D549BB355EB71AA85CF90

Function 063AEBA0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0f20c23110330b0296cbcafda1a599e6b7cabe8f299256cbb0ad181170cbee
Instruction ID: 91b9a271b51b7a66b0ea76dacfebcfdc4f172ebeb739371db8ac35e974531eca
Opcode Fuzzy Hash: eb0f20c23110330b0296cbcafda1a599e6b7cabe8f299256cbb0ad181170cbee
Instruction Fuzzy Hash: 41811A30E002499FDB54DFA8D994AADBBF6FF88300F248529E415EB355DB30E946DB90

Function 063AEBB0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b3cf232e9e0255c2d8471d07a28227aefdecfce8970eaac6224235456b65f5
Instruction ID: fd9db8fd5e14dbeaeb03aafdd9b87e3a1ebd4a6dc0488a08e34ed1e9af9f2826
Opcode Fuzzy Hash: a1b3cf232e9e0255c2d8471d07a28227aefdecfce8970eaac6224235456b65f5
Instruction Fuzzy Hash: B6710930E002499FDB54EFA9D990AADBBF6FF88300F148529E415EB355DB30E946DB90

Function 063A4C08 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81e8ad5e53c12d70fa61eb4fdce5b7b0dbf197914f546200f0a8aa8b347b0b2
Instruction ID: fc1989da9cac4d2533aa400eefd23b243a2be2fb853476fab386ba368ce3f559
Opcode Fuzzy Hash: d81e8ad5e53c12d70fa61eb4fdce5b7b0dbf197914f546200f0a8aa8b347b0b2
Instruction Fuzzy Hash: C8617330F002189FEB54DFA9C8547AEBBF6EF88310F208429E506EB395DB758D459B90

Function 063AFAC0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df99bcf3b65a114a4e8970396f58b5c487e0213d9cdc13b32aaeebb6e264519
Instruction ID: 3593671085fced7391dc39b4b769301bdd22084618e46dd78fddde3fbe3e40ae
Opcode Fuzzy Hash: 8df99bcf3b65a114a4e8970396f58b5c487e0213d9cdc13b32aaeebb6e264519
Instruction Fuzzy Hash: 62518330F102148BEF64666CD8A477F76BAD79A700F20452EE50AC73D5CA6CCC9697E1

Function 063AFAD0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f924d020476693723567dbad3279578679b3f656b504c6c6fbfe0630d9d16639
Instruction ID: 5ffadc0cebf5c5ff18b3e9bec58f2e1af4f2eb2ecd9dd2682683b35ccfff418a
Opcode Fuzzy Hash: f924d020476693723567dbad3279578679b3f656b504c6c6fbfe0630d9d16639
Instruction Fuzzy Hash: 8051A130F102049BEF64666CD86477F76BAE79A700F20453EE50AC7395CA6CCC9697E2

Function 063A91E6 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947e3085a9557e941911e7b0e085365fc649fdfe2c7eeec4c738fac6776a03ee
Instruction ID: e02c3b8e0d25b608b40ffe28f73dbbf13a2a360992c7ce35f518fbd4a6a15a05
Opcode Fuzzy Hash: 947e3085a9557e941911e7b0e085365fc649fdfe2c7eeec4c738fac6776a03ee
Instruction Fuzzy Hash: 57514430B112468FDB54EB78D890BAE77F6FFC9240F148569C805EB788EA31DC429B90

Function 063A4BF8 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d86c607a6717dbb28b8783d0cdcb97e1d92f76e1684eed75a6cbd84321f4b5
Instruction ID: cadfa15d59f39bd01005818e638ba14a2d43e71f03fbd1efd06e7ffc20dd00ee
Opcode Fuzzy Hash: 29d86c607a6717dbb28b8783d0cdcb97e1d92f76e1684eed75a6cbd84321f4b5
Instruction Fuzzy Hash: 16516330F102189FEB54DFA5C8547AEBBF6EF88700F208529E505EB395DB755C058BA1

Function 063A5630 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab1da9d6525237f30211d82fdbf41e4ed6a69d7e042024cd896e75d9d67064d
Instruction ID: b3407083798ef4656fa97e1a9216ee5f83124ad3f7975e6c23358124d1630e82
Opcode Fuzzy Hash: 0ab1da9d6525237f30211d82fdbf41e4ed6a69d7e042024cd896e75d9d67064d
Instruction Fuzzy Hash: 08418D75E102068BDF648BA8C480B7EFBB5FB45320F248926E415EB291C735EC85DBD1

Function 063A54B0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92280a44d2f888308ac87dff0e7ba8f6cd727d80fca31e242f7df08d83fc796
Instruction ID: 495e11d7ff5ca5e997e8346aceb064fef40afbb25341936bbbace3d07a336bed
Opcode Fuzzy Hash: b92280a44d2f888308ac87dff0e7ba8f6cd727d80fca31e242f7df08d83fc796
Instruction Fuzzy Hash: 09414C72E007058FDF60CEA9D880AAEFBB2FB85220F10492AE156D7650D330E9599BD0

Function 063ADB4D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a44e6be602b737ff6db9e9dec17d6f131dc3d93faf1a7b99e86991ff62d3da
Instruction ID: f0c5de2726fdfaf388ce3698df9689991819c8375359a71a8dcd627bd50998b6
Opcode Fuzzy Hash: b7a44e6be602b737ff6db9e9dec17d6f131dc3d93faf1a7b99e86991ff62d3da
Instruction Fuzzy Hash: 57418F30E10349DFDB659F79D8946AEBBB6EF86300F204529D402DB741DB70984ADBD1

Function 063A22A8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f33e19427e7e4b29f2973a3c28eaebe6aac0ce90bddf1a43fafbbe58bc71c4
Instruction ID: 72e55e7fa02c758a3af6e7855872e62bd263ff2c0ec1deefad2c9b96f7d94b6f
Opcode Fuzzy Hash: f1f33e19427e7e4b29f2973a3c28eaebe6aac0ce90bddf1a43fafbbe58bc71c4
Instruction Fuzzy Hash: 74319E30B103058FDB94AB79D85466F7AA7FB8A600F244428D406DB395EE35DD0ADBE1

Function 063A2158 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528c7bb5228a37c1acc60e2c31f56d5f8bf0bba2a19b95c22724663ac72fa4f8
Instruction ID: ac3f44a031bdb21f5b49df6c3dec5c4f17261b8c6bc15564445fac5e68a9dc11
Opcode Fuzzy Hash: 528c7bb5228a37c1acc60e2c31f56d5f8bf0bba2a19b95c22724663ac72fa4f8
Instruction Fuzzy Hash: 59316E34E102069BCB99CFA4D8546AFB7F6FF89300F148519E916EB740DB31AE46CB90

Function 063A2168 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d7284a1fe8b14c3059cb35d37d5dc1b8bc7708be1011d84e6a71972408b21c
Instruction ID: ed05c7be0e5e9f40f366d9e36f915f0da41677a79c0395860efc655edfb7e7da
Opcode Fuzzy Hash: e3d7284a1fe8b14c3059cb35d37d5dc1b8bc7708be1011d84e6a71972408b21c
Instruction Fuzzy Hash: 20316E30E106069BCB59CFA4D8546AFB7F6FF89300F148529E916EB740DB71AE46CB90

Function 063A3B38 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a102d1ab5b15f995391047a5edd2d13eb236bb45c4c4cc48355cfa29342911e4
Instruction ID: 24dce276defff21db3a3deda098bda1ad75d9465a7943f70f99f1a4eced34f7b
Opcode Fuzzy Hash: a102d1ab5b15f995391047a5edd2d13eb236bb45c4c4cc48355cfa29342911e4
Instruction Fuzzy Hash: DE217A71F003559FEB50DFA8D840AEEBBF2EB88310F248029E905E7380E735D8029B90

Function 063A3B48 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca414a1be77478619581ca70c6fd1c823b1f9eebe7222ba271cf83f8cc492eb
Instruction ID: 68b1839b6cc6ab3822f0d2f5dcf75b436261401e9c54f2b7fef82799f3e5586e
Opcode Fuzzy Hash: eca414a1be77478619581ca70c6fd1c823b1f9eebe7222ba271cf83f8cc492eb
Instruction Fuzzy Hash: 09218975F017599FEB50DFA9D880AAEBBF6EB48710F208129E905E7380E735D905CB90

Function 00D7D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3360976337.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d7d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8791def8987c0e3280e4ff5c5a93655cbf8d3902f204a7a8b183b2678538b25
Instruction ID: df070bd113d1d65daf59ac0b0ea5d8741974f9d7056b50fede95b4e01475a2c0
Opcode Fuzzy Hash: e8791def8987c0e3280e4ff5c5a93655cbf8d3902f204a7a8b183b2678538b25
Instruction Fuzzy Hash: C721DE71604204EFDB14DF24D980B26BBB6FF84314F28C56DE94E4B292D37AD846CA72

Function 00D7D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3360976337.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_d7d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089f979ed8e81b481fb65d26878b497f31e3e46c15e9437b63f99d8895cb6b59
Instruction ID: 32d48864442c8574519344c7b9775eacd425c30a624473d0fc82ae1fe8335bcb
Opcode Fuzzy Hash: 089f979ed8e81b481fb65d26878b497f31e3e46c15e9437b63f99d8895cb6b59
Instruction Fuzzy Hash: B8214B7150D3C09FC703CB24D990711BF71AF46214F29C5EBD8898F2A7D23A980ACB62

Function 063A3C58 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3479ae2cabcfe7171b911a8e48f38d7b98462312964dc4317f94c55ab93c57bd
Instruction ID: a075eebf9fdbffb37070fb9b3b38ec36e2f33a33f11bef2f57d3e5f7dd42bbb4
Opcode Fuzzy Hash: 3479ae2cabcfe7171b911a8e48f38d7b98462312964dc4317f94c55ab93c57bd
Instruction Fuzzy Hash: 8D11E131F102258FEB549668DC14AEE73BAEBC9710F004439C506E7344EE24DC029BD0

Function 063AEE21 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8915598a18ec0b49c74797b6d8ce6fd3a0489a92529d89c545691154689fa9f9
Instruction ID: 46df1dbade5042191907c06ce2f60fb8f6f9c9327b182797e51ff104f7235b51
Opcode Fuzzy Hash: 8915598a18ec0b49c74797b6d8ce6fd3a0489a92529d89c545691154689fa9f9
Instruction Fuzzy Hash: 4801D431B102215FDBA59A7C9460B2B77EAEBCA710F10483AE50ACB380DA20DC0697D1

Function 063A4298 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a088acdeb0d25e4ac7d7725f4e6c69ea38cad87938eca9956bdc1a22d40e6a3
Instruction ID: 1640a271b480d48d648b28b5cea901251f35d92d8d0f1cd1c402978a72c28e56
Opcode Fuzzy Hash: 5a088acdeb0d25e4ac7d7725f4e6c69ea38cad87938eca9956bdc1a22d40e6a3
Instruction Fuzzy Hash: 0E019231B002511BDBB59ABD941472AB7DADBCA710F14883EE54ACB386EDA1DC4643D1

Function 063A3910 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d71a07f74a7777732eb9781bd0d701ce3b129e7fdf5b80cbe73d05c22ad522
Instruction ID: 6e8fcfcd25eb83b037cbc3bf6a62dc18383a1987b6d98db71e1f9e2779ef2271
Opcode Fuzzy Hash: 34d71a07f74a7777732eb9781bd0d701ce3b129e7fdf5b80cbe73d05c22ad522
Instruction Fuzzy Hash: 4A21E0B5C01259AFDB10CF9AD885ACEFFB4FB49310F10812AE918A7340C374A944CBA5

Function 063AA3A9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 126ab0cad3effa3dfd571ed0ca378bb2bf5a2bf9f72bfb09dd5fd90f1dee60a6
Instruction ID: 565fc3c690ce1511cc33a5d3016160bde481c617fb80893f558d4bc1d6e78c8b
Opcode Fuzzy Hash: 126ab0cad3effa3dfd571ed0ca378bb2bf5a2bf9f72bfb09dd5fd90f1dee60a6
Instruction Fuzzy Hash: DD01D431B102504FDB659B7CD96472AB7E6EB8A710F204869F18ACB391EE21DC06C7E0

Function 063A3C48 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2168585b9a9a8bda809866004f092c850e3deaf56b376eebe91006fb032ef73
Instruction ID: 283d0b331e9444c9e49444ea316bc4bfb8fae40347bac22bcddee00f8d361b03
Opcode Fuzzy Hash: a2168585b9a9a8bda809866004f092c850e3deaf56b376eebe91006fb032ef73
Instruction Fuzzy Hash: 65012431B102654BEB54AA78DC60AEBB7FAEFCA350F104439D446D7284EA20CC02A7E1

Function 063A3918 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9976f31d811111d81e353a6ae67a28d343a4859c014d6010c0c6512cb6b6fa
Instruction ID: 7c1d9e9e7f644fc760f5ffb08930ac14d59244b300cfb2f1de9b890d99841f06
Opcode Fuzzy Hash: 1a9976f31d811111d81e353a6ae67a28d343a4859c014d6010c0c6512cb6b6fa
Instruction Fuzzy Hash: 7611CFB5D01619AFDB00CF9AD984ADEFBF4FB48310F10812AE918A7340C374A954CBA5

Function 063A42A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adfa6aca7bd350739cb5cf8431d0d8f780eefe6a288c157ccecfb5ada18944ef
Instruction ID: ab6dab45bf74ef7a9cf14baefb50a7f6d350dc7fe0ab4ccad9dff3da48e1a7c3
Opcode Fuzzy Hash: adfa6aca7bd350739cb5cf8431d0d8f780eefe6a288c157ccecfb5ada18944ef
Instruction Fuzzy Hash: 79018631B102140BDB7999AD945472FB2DADBC9710F148439E10AC7385EDA1DC4643D1

Function 063AEE30 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b2ac8a10fc08f6e27447c44f60836461e1b941cac8123238e6515f59b22a0a
Instruction ID: 1cc033dd1dc9134a2fd6209f86ba52ee5c6db31ca96bd97bf063bdbc16b92ad3
Opcode Fuzzy Hash: 32b2ac8a10fc08f6e27447c44f60836461e1b941cac8123238e6515f59b22a0a
Instruction Fuzzy Hash: AF01AF31B102114BDBB9967D9450B2F73DAEBCA720F10883EE20ACB380EE21DC0663D5

Function 063AA3B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffc81c3ada8ee91a1e5cca0a12173d8d0b9888e9b76edec7ee7c9a2cc9cc264
Instruction ID: 584a8029706f3782feb8ef3eb655e19b4f43faf37e9411c570f0bc7420213d46
Opcode Fuzzy Hash: 7ffc81c3ada8ee91a1e5cca0a12173d8d0b9888e9b76edec7ee7c9a2cc9cc264
Instruction Fuzzy Hash: 5E014431B106104BDBA9EA7CD85472A73D6EB89710F508838F10ACB3D4EE22DC4687E0

Function 063AC870 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0baa641caddca158dd03695271a48d435085b40fd1ff0da22aeb325cf89cb431
Instruction ID: a671dfb4462dd208833000a095de6b20939bc37931b34adfcba33ad7ac787b38
Opcode Fuzzy Hash: 0baa641caddca158dd03695271a48d435085b40fd1ff0da22aeb325cf89cb431
Instruction Fuzzy Hash: F901A931F102149BDB68AA7DE8416AEB77AF785310F004539E905EB385DB31A905C7D4

Function 063A8370 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcf01f410f6089c9a8c2865f6ed9ef2103cc1769a7b0da07085e2abc7b92591
Instruction ID: 6ee3c689570dcf644197e45e222fbbfd47367d9728e56e65455b4717d5bbad7a
Opcode Fuzzy Hash: 6dcf01f410f6089c9a8c2865f6ed9ef2103cc1769a7b0da07085e2abc7b92591
Instruction Fuzzy Hash: 52F0C239B00301CFEFA89E58ED8467DB3A8EB41314F244466DA85CB6C5D672D90AD7D1

Function 063A6511 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3369580975.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_63a0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef01574f45351863d6d9099d006fcf9e5b19cc80c00686fc990ee12f96e1196
Instruction ID: 78f3fdf7a403ac574a3f8bf3b5c564a9afe9272972f75e2dcaa2860b4747eea8
Opcode Fuzzy Hash: 7ef01574f45351863d6d9099d006fcf9e5b19cc80c00686fc990ee12f96e1196
Instruction Fuzzy Hash: 82E0DF72E14309ABEB90CEB0C95671B7BAADB43204F2488A6D405C7202E136CE06ABC0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_2.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qHqJcuLw.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3uhuktwx.pnf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fd0434iv.evp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ghcx1pe0.htk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwjhha2j.vou.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nl52yuir.5ok.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qsaebg2q.oef.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfi4kfp0.y3h.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjiaefui.gd1.psm1

Windows Analysis Report
LisectAVT_2403002A_2.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre